Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted image file.

According to the version of the jbigkit package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Stack-based buffer overflow in the jbg_dec_in function     in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote     attackers to cause a denial of service (application     crash) and possibly execute arbitrary code via a     crafted image file.(CVE-2013-6369)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated jbigkit packages fix security vulnerability :

Florian Weimer found a stack-based buffer overflow flaw in the libjbig library (part of jbigkit). A specially crafted image file read by libjbig could be used to cause a program linked to libjbig to crash or, potentially, to execute arbitrary code (CVE-2013-6369).

The jbigkit package has been updated to version 2.1, which fixes this issue, as well as a few other bugs, including the ability of corrupted input data to force the jbig85 decoder into an end-less loop.

The following security issue is fixed in this update

  - [bnc#870855] - CVE-2013-6369: jbigkit buffer overflow

The remote host is affected by the vulnerability described in GLSA-201405-20 (JBIG-KIT: Denial of Service)

    JBIG-KIT contains a stack-based buffer overflow in the jbg_dec_in       function in libjbig/jbig.c.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition via       a specially crafted image file.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2190-1 advisory.

    Florian Weimer discovered that JBIG-KIT incorrectly handled certain malformed images. If a user or     automated system were tricked into processing a specially crafted image, JBIG-KIT could be made to crash,     or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes a stack-based buffer overflow flaw.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in jbigkit :

Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted image file (CVE-2013-6369).

The updated packages for mbs1 have been upgraded to the 2.1 version and the packages for mes5 has been patched to resolve this security flaw.

Florian Weimer of the Red Hat product security team discovered multiple buffer overflows in jbigkit, which could lead to the execution of arbitrary code when processing malformed images.

ID	Name	Product	Family	Severity
124933	EulerOS Virtualization 3.0.1.0 : jbigkit (EulerOS-SA-2019-1430)	Nessus	Huawei Local Security Checks	medium
82354	Mandriva Linux Security Advisory : jbigkit (MDVSA-2015:101)	Nessus	Mandriva Local Security Checks	medium
78280	Amazon Linux AMI : jbigkit (ALAS-2014-337)	Nessus	Amazon Linux Local Security Checks	medium
77134	openSUSE Security Update : jbigkit (openSUSE-SU-2014:0978-1)	Nessus	SuSE Local Security Checks	medium
74062	GLSA-201405-20 : JBIG-KIT: Denial of Service	Nessus	Gentoo Local Security Checks	medium
73821	Ubuntu 14.04 LTS : JBIG-KIT vulnerability (USN-2190-1)	Nessus	Ubuntu Local Security Checks	high
73658	Fedora 19 : jbigkit-2.0-9.fc19 (2014-4960)	Nessus	Fedora Local Security Checks	medium
73545	Fedora 20 : jbigkit-2.0-10.fc20 (2014-4948)	Nessus	Fedora Local Security Checks	medium
73489	Mandriva Linux Security Advisory : jbigkit (MDVSA-2014:077)	Nessus	Mandriva Local Security Checks	medium
73465	Debian DSA-2900-1 : jbigkit - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-6369

high

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium