FreeBSD : jasper -- multiple vulnerabilities (f1692469-45ce-11e5-adde-14dae9d210b8)

Medium Nessus Plugin ID 85523

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Martin Prpic reports :

A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Feist Josselin reports :

A new use-after-free was found in Jasper JPEG-200. The use-after-free appears in the function mif_process_cmpt of the src/libjasper/mif/mif_cod.c file.

Solution

Update the affected package.

See Also

https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c0

https://seclists.org/oss-sec/2015/q3/366

https://seclists.org/oss-sec/2015/q3/408

http://www.nessus.org/u?442f86e2

Plugin Details

Severity: Medium

ID: 85523

File Name: freebsd_pkg_f169246945ce11e5adde14dae9d210b8.nasl

Version: 2.8

Type: local

Published: 2015/08/19

Updated: 2018/11/23

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS v3.0

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:jasper, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2015/08/18

Vulnerability Publication Date: 2015/08/17

Reference Information

CVE: CVE-2015-5203, CVE-2015-5221