This update for jasper fixes the following issues: Security issues fixed :

  - CVE-2016-9262: Multiple integer overflows in the     jas_realloc function in base/jas_malloc.c and mem_resize     function in base/jas_stream.c allow remote attackers to     cause a denial of service via a crafted image, which     triggers use after free vulnerabilities. (bsc#1009994)

  - CVE-2016-9388: The ras_getcmap function in ras_dec.c     allows remote attackers to cause a denial of service     (assertion failure) via a crafted image file.
    (bsc#1010975)

  - CVE-2016-9389: The jpc_irct and jpc_iict functions in     jpc_mct.c allow remote attackers to cause a denial of     service (assertion failure). (bsc#1010968)

  - CVE-2016-9390: The jas_seq2d_create function in     jas_seq.c allows remote attackers to cause a denial of     service (assertion failure) via a crafted image file.
    (bsc#1010774)

  - CVE-2016-9391: The jpc_bitstream_getbits function in     jpc_bs.c allows remote attackers to cause a denial of     service (assertion failure) via a very large integer.
    (bsc#1010782)

  - CVE-2017-1000050: The jp2_encode function in jp2_enc.c     allows remote attackers to cause a denial of service.
    (bsc#1047958) CVEs already fixed with previous update :

  - CVE-2016-9392: The calcstepsizes function in jpc_dec.c     allows remote attackers to cause a denial of service     (assertion failure) via a crafted file. (bsc#1010757)

  - CVE-2016-9393: The jpc_pi_nextrpcl function in     jpc_t2cod.c allows remote attackers to cause a denial of     service (assertion failure) via a crafted file.
    (bsc#1010766)

  - CVE-2016-9394: The jas_seq2d_create function in     jas_seq.c allows remote attackers to cause a denial of     service (assertion failure) via a crafted file.
    (bsc#1010756)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1208 advisory.

    - Multiple security fixes (fixed by thoger):
      CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089       CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692       CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262       CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391       CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583       CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
    - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183672)
    - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183680)
    - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173567)
    - CVE-2014-8138 - heap overflow in jp2_decode (#1173567)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

Security Fix(es) :

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-8654, CVE-2016-9583, CVE-2016-9591, and CVE-2016-9600;
Gustavo Grieco for reporting CVE-2015-5203; and Josselin Feist for reporting CVE-2015-5221.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3693-1 advisory.

    It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or     automated system using JasPer were tricked into opening a specially crafted image, an attacker could     exploit this to cause a denial of service or possibly execute code with the privileges of the user     invoking the program.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
101891	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2017:1916-1)	Nessus	SuSE Local Security Checks	2017/7/21	2025/12/9	high
100089	Oracle Linux 6 / 7 : jasper (ELSA-2017-1208)	Nessus	Oracle Linux Local Security Checks	2017/5/10	2025/12/19	high
100174	CentOS 6 / 7 : jasper (CESA-2017:1208)	Nessus	CentOS Local Security Checks	2017/5/16	2025/12/18	high
110765	Ubuntu 14.04 LTS / 16.04 LTS : JasPer vulnerabilities (USN-3693-1)	Nessus	Ubuntu Local Security Checks	2018/6/28	2024/8/27	high

検出

プラグインの検索

high

high

high

high