openSUSE Security Update : jasper (openSUSE-2017-478)

Medium Nessus Plugin ID 99429


The remote openSUSE host is missing a security update.


This update for jasper fixes the following issues :

Security issues fixed :

- CVE-2016-9600: NULL pointer Dereference due to missing check for UNKNOWN color space in JP2 encoder (bsc#1018088)

- CVE-2016-10251: Use of uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

- CVE-2017-5498: left-shift undefined behaviour (bsc#1020353)

- CVE-2017-6850: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

- CVE-2016-9583: Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400)

This update was imported from the SUSE:SLE-12:Update update project.


Update the affected jasper packages.

See Also

Plugin Details

Severity: Medium

ID: 99429

File Name: openSUSE-2017-478.nasl

Version: $Revision: 3.3 $

Type: local

Agent: unix

Published: 2017/04/18

Modified: 2018/01/26

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P


Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:jasper, p-cpe:/a:novell:opensuse:jasper-debuginfo, p-cpe:/a:novell:opensuse:jasper-debugsource, p-cpe:/a:novell:opensuse:libjasper-devel, p-cpe:/a:novell:opensuse:libjasper1, p-cpe:/a:novell:opensuse:libjasper1-32bit, p-cpe:/a:novell:opensuse:libjasper1-debuginfo, p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit, cpe:/o:novell:opensuse:42.1, cpe:/o:novell:opensuse:42.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2017/04/18

Reference Information

CVE: CVE-2016-10251, CVE-2016-9583, CVE-2016-9600, CVE-2017-5498, CVE-2017-6850