FreeBSD : jasper -- multiple vulnerabilities (f1692469-45ce-11e5-adde-14dae9d210b8)

medium Nessus Plugin ID 85523

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Martin Prpic reports :

A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Feist Josselin reports :

A new use-after-free was found in Jasper JPEG-200. The use-after-free appears in the function mif_process_cmpt of the src/libjasper/mif/mif_cod.c file.

Solution

Update the affected package.

Plugin Details

Severity: Medium

ID: 85523

File Name: freebsd_pkg_f169246945ce11e5adde14dae9d210b8.nasl

Version: 2.10

Type: local

Family: FreeBSD Local Security Checks

Published: 8/19/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:jasper, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 8/18/2015

Vulnerability Publication Date: 8/17/2015

Reference Information

CVE: CVE-2015-5203, CVE-2015-5221

Detections

Analytics