https://blogs.gentoo.org/ago/2017/01/25/jasper-null-pointer-dereference-in-jp2_cdef_destroy-jp2_cod-c/

https://github.com/mdadams/jasper/commit/e96fc4fdd525fa0ede28074a7e2b1caf94b58b0d

https://github.com/mdadams/jasper/issues/112

USN-3693-1

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The jp2_colr_destroy function in jp2_cod.c in JasPer     before 1.900.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) by     leveraging incorrect cleanup of JP2 box data on error.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-8887.(CVE-2016-10250)

  - The jp2_colr_destroy function in     libjasper/jp2/jp2_cod.c in JasPer before 1.900.10     allows remote attackers to cause a denial of service     (NULL pointer dereference).(CVE-2016-8887)

  - The jp2_cdef_destroy function in jp2_cod.c in JasPer     before 2.0.13 allows remote attackers to cause a denial     of service (NULL pointer dereference) via a crafted     image.(CVE-2017-6850)

  - The jas_malloc function in libjasper/base/jas_malloc.c     in JasPer before 1.900.11 allows remote attackers to     have unspecified impact via a crafted file, which     triggers a memory allocation failure.(CVE-2016-8886)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Race condition in the jas_stream_tmpfile function in     libjasper/base/jas_stream.c in JasPer 1.900.1 allows     local users to cause a denial of service (program exit)     by creating the appropriate tmp.XXXXXXXXXX temporary     file, which causes Jasper to exit. NOTE: this was     originally reported as a symlink issue, but this was     incorrect. NOTE: some vendors dispute the severity of     this issue, but it satisfies CVE's requirements for     inclusion.(CVE-2008-3521)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

  - The jp2_colr_destroy function in jp2_cod.c in JasPer     before 1.900.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) by     leveraging incorrect cleanup of JP2 box data on error.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-8887.(CVE-2016-10250)

  - The jp2_cdef_destroy function in jp2_cod.c in JasPer     before 2.0.13 allows remote attackers to cause a denial     of service (NULL pointer dereference) via a crafted     image.(CVE-2017-6850)

  - The jp2_colr_destroy function in     libjasper/jp2/jp2_cod.c in JasPer before 1.900.10     allows remote attackers to cause a denial of service     (NULL pointer dereference).(CVE-2016-8887)

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The jp2_colr_destroy function in     libjasper/jp2/jp2_cod.c in JasPer before 1.900.10     allows remote attackers to cause a denial of service     (NULL pointer dereference).(CVE-2016-8887)

  - The jp2_cdef_destroy function in jp2_cod.c in JasPer     before 2.0.13 allows remote attackers to cause a denial     of service (NULL pointer dereference) via a crafted     image.(CVE-2017-6850)

  - The jp2_colr_destroy function in jp2_cod.c in JasPer     before 1.900.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) by     leveraging incorrect cleanup of JP2 box data on error.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-8887.(CVE-2016-10250)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

  - Race condition in the jas_stream_tmpfile function in     libjasper/base/jas_stream.c in JasPer 1.900.1 allows     local users to cause a denial of service (program exit)     by creating the appropriate tmp.XXXXXXXXXX temporary     file, which causes Jasper to exit. NOTE: this was     originally reported as a symlink issue, but this was     incorrect. NOTE: some vendors dispute the severity of     this issue, but it satisfies CVE's requirements for     inclusion.(CVE-2008-3521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

Security issues fixed :

  - CVE-2016-9600: NULL pointer Dereference due to missing     check for UNKNOWN color space in JP2 encoder     (bsc#1018088)

  - CVE-2016-10251: Use of uninitialized value in     jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

  - CVE-2017-5498: left-shift undefined behaviour     (bsc#1020353)

  - CVE-2017-6850: NULL pointer dereference in     jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

  - CVE-2016-9583: Out of bounds heap read in     jpc_pi_nextpcrl() (bsc#1015400)

This update was imported from the SUSE:SLE-12:Update update project.

This update for jasper fixes the following issues: Security issues fixed :

  - CVE-2016-9600: NULL pointer Dereference due to missing     check for UNKNOWN color space in JP2 encoder     (bsc#1018088)

  - CVE-2016-10251: Use of uninitialized value in     jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

  - CVE-2017-5498: left-shift undefined behaviour     (bsc#1020353)

  - CVE-2017-6850: NULL pointer dereference in     jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

  - CVE-2016-9583: Out of bounds heap read in     jpc_pi_nextpcrl() (bsc#1015400)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues: Security issues fixed :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec (bsc#1012530)

  - CVE-2016-9395: Missing sanity checks on the data in a     SIZ marker segment (bsc#1010977).

  - CVE-2016-9398: jpc_math.c:94: int jpc_floorlog2(int):
    Assertion 'x > 0' failed. (bsc#1010979)

  - CVE-2016-9560: stack-based buffer overflow in     jpc_tsfb_getbands2 (jpc_tsfb.c) (bsc#1011830)

  - CVE-2016-9583: Out of bounds heap read in     jpc_pi_nextpcrl() (bsc#1015400)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy (bsc#1015993)

  - CVE-2016-9600: NULL pointer Dereference due to missing     check for UNKNOWN color space in JP2 encoder     (bsc#1018088)

  - CVE-2016-10251: Use of uninitialized value in     jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

  - CVE-2017-5498: left-shift undefined behaviour     (bsc#1020353)

  - CVE-2017-6850: NULL pointer dereference in     jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
135522	EulerOS 2.0 SP3 : jasper (EulerOS-SA-2020-1393)	Nessus	Huawei Local Security Checks	medium
134477	EulerOS Virtualization for ARM 64 3.0.2.0 : jasper (EulerOS-SA-2020-1188)	Nessus	Huawei Local Security Checks	high
130699	EulerOS 2.0 SP5 : jasper (EulerOS-SA-2019-2237)	Nessus	Huawei Local Security Checks	high
110765	Ubuntu 14.04 LTS / 16.04 LTS : jasper vulnerabilities (USN-3693-1)	Nessus	Ubuntu Local Security Checks	medium
99429	openSUSE Security Update : jasper (openSUSE-2017-478)	Nessus	SuSE Local Security Checks	medium
99245	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2017:0953-1)	Nessus	SuSE Local Security Checks	medium
99232	SUSE SLES11 Security Update : jasper (SUSE-SU-2017:0946-1)	Nessus	SuSE Local Security Checks	medium

CVE-2017-6850

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins