Detections
Analytics
Alpine: multiple jasper packages: security update to 1.900.1-r11 (deprecated)
high Tenable Cloud Security Plugin ID 401069
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows
remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC
color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. (CVE-2016-1577)
- The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of
service (invalid read and application crash) via a crafted JPEG 2000 image. (CVE-2016-2089)
- Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote
attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000
image file. (CVE-2016-2116)
See Also
https://git.alpinelinux.org/aports/commit/?id=244e4d797e740c7fedf8e3e9df9d9d85859b11b4
https://git.alpinelinux.org/aports/commit/?id=ef66a83f94e9a7f83c00f3487a85387c576a8d52
Plugin Details
Severity: High
ID: 401069
Version: Revision 1.25
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.9
Percentile: 52.21
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2016-1577
CVSS v3
Risk Factor: High
Base Score: 7.6
Temporal Score: 6.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/11/2016
Vulnerability Publication Date: 2/8/2016