Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - JasPer の jpc/jpc_dec.c の関数 jpc_dec_process_sot() に到達可能なアサーションアボートがあり 2.0.12 、予期しない jpc_ppmstabtostreams 戻り値をトリガーすることにより、リモートサービス拒否攻撃を引き起こします。これは、 CVE-2018-9154とは異なる脆弱性です。 （CVE-2017-13745）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

遠端主機受到 GLSA-201908-03 中所述的弱點影響 (JasPer：多個弱點) 在 JasPer 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：如需詳細資料，請檢閱提及的 CVE 識別碼。因應措施：目前尚無已知的因應措施。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 JasPer 2.0.12 的 jpc/jpc_dec.c 中，jpc_dec_process_sot() 函式發生可連線宣告中止，這將透過觸發非預期的 jpc_ppmstabtostreams 傳回值而導致遠端拒絕服務攻擊，此弱點不同於 CVE-2018-9154。 (CVE-2017-13745)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - JasPer 2.0.12 的 jpc/jpc_dec.c 中的函数 jpc_dec_process_sot() 中存在可访问断言中止，将通过触发非预期的 jpc_ppmstabtostreams 返回值，导致远程拒绝服务攻击，此漏洞与 CVE-2018-9154不同。 (CVE-2017-13745)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The remote host is affected by the vulnerability described in GLSA-201908-03 (JasPer: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in JasPer. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-0a6290f865 advisory.

  - The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause     a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. (CVE-2016-9396)

  - The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9397)

  - The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified vectors. (CVE-2016-9398)

  - The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9399)

  - There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer     2.0.12 that will lead to a remote denial of service attack by triggering an unexpected     jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13746)

  - There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13747)

  - There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of service attack. (CVE-2017-13748)

  - There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13749)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13750)

  - There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13751)

  - There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13752)

  - JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17,     1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27,     1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8,     2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of     service (heap-based buffer over-read and application crash) via a crafted image, related to the     jas_image_ishomosamp function in libjasper/base/jas_image.c. (CVE-2017-14132)

  - JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check     to see if the image contained at least one component resulting in a denial-of-service. (CVE-2017-1000050)

  - There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an     attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality,     integrity, or application availability. (CVE-2020-27828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

远程主机受到 GLSA-201908-03 中所述漏洞的影响（JasPer：多个漏洞）在 JasPer 中发现多个漏洞。请检查下面供参考的 CVE 标识符以了解详细信息。影响：如需详细信息，请查看供参考的 CVE 标识符。解决方法：目前无任何已知的解决方法。

リモートホストは、GLSA-201908-03（JasPer：複数の脆弱性）で説明されている脆弱性による影響を受けます。複数の脆弱性がJasPerで発見されています。詳細については、以下に記載されているCVE識別番号を参照してください。影響：詳細については、記載されているCVE識別番号を参照してください。回避策：現時点では、既知の回避策はありません。

報告されたすべてのCVE修正を含む新しいUpstreamバージョン2.0.24が利用可能です。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer     2.0.12 that will lead to a remote denial of service attack by triggering an unexpected     jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-2b151590d9 advisory.

  - The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause     a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. (CVE-2016-9396)

  - The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9397)

  - The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified vectors. (CVE-2016-9398)

  - The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9399)

  - There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer     2.0.12 that will lead to a remote denial of service attack by triggering an unexpected     jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13746)

  - There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13747)

  - There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of service attack. (CVE-2017-13748)

  - There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13749)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13750)

  - There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13751)

  - There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13752)

  - JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17,     1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27,     1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8,     2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of     service (heap-based buffer over-read and application crash) via a crafted image, related to the     jas_image_ishomosamp function in libjasper/base/jas_image.c. (CVE-2017-14132)

  - JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check     to see if the image contained at least one component resulting in a denial-of-service. (CVE-2017-1000050)

  - There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an     attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality,     integrity, or application availability. (CVE-2020-27828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
220720	Linux Distros のパッチ未適用の脆弱性: CVE-2017-13745	Nessus	Misc.	3/4/2025	3/4/2025	high
127561	GLSA-201908-03：JasPer：多個弱點	Nessus	Gentoo Local Security Checks	8/12/2019	5/7/2024	high
220720	Linux Distros 未修補弱點：CVE-2017-13745	Nessus	Misc.	3/4/2025	3/4/2025	high
220720	Linux Distros 未修补的漏洞: CVE-2017-13745	Nessus	Misc.	3/4/2025	3/4/2025	high
127561	GLSA-201908-03 : JasPer: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/12/2019	5/7/2024	high
146125	Fedora 32 : jasper (2021-0a6290f865)	Nessus	Fedora Local Security Checks	2/4/2021	1/24/2024	high
127561	GLSA-201908-03：JasPer：多个漏洞	Nessus	Gentoo Local Security Checks	8/12/2019	5/7/2024	high
127561	GLSA-201908-03：JasPer：複数の脆弱性	Nessus	Gentoo Local Security Checks	8/12/2019	5/7/2024	high
146125	Fedora 32：jasper（2021-0a6290f865）	Nessus	Fedora Local Security Checks	2/4/2021	1/24/2024	high
220720	Linux Distros Unpatched Vulnerability : CVE-2017-13745	Nessus	Misc.	3/4/2025	3/4/2025	high
145784	Fedora 33：jasper（2021-2b151590d9）	Nessus	Fedora Local Security Checks	2/1/2021	1/25/2024	high
145784	Fedora 33 : jasper (2021-2b151590d9)	Nessus	Fedora Local Security Checks	2/1/2021	1/25/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high