Amazon Linux AMI : jasper (ALAS-2011-29)

medium Nessus Plugin ID 69588

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

Two heap-based buffer overflow flaws were found in the way JasPer decoded JPEG 2000 compressed image files. An attacker could create a malicious JPEG 2000 compressed image file that, when opened, would cause applications that use JasPer (such as Nautilus) to crash or, potentially, execute arbitrary code.

Solution

Run 'yum update jasper' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2011-29.html

Plugin Details

Severity: Medium

ID: 69588

File Name: ala_ALAS-2011-29.nasl

Version: 1.8

Type: local

Agent: unix

Published: 9/4/2013

Updated: 10/16/2019

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:jasper, p-cpe:/a:amazon:linux:jasper-debuginfo, p-cpe:/a:amazon:linux:jasper-devel, p-cpe:/a:amazon:linux:jasper-libs, p-cpe:/a:amazon:linux:jasper-utils, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/14/2014

Vulnerability Publication Date: 12/14/2011

Reference Information

CVE: CVE-2011-4516

ALAS: 2011-29

RHSA: 2011:1807