远程 Oracle 数据库服务器缺少 2020 年 4 月关键补丁更新 (CPU)。因此，该应用程序受到多个漏洞的影响：
  - Oracle 数据库服务器的 Oracle 多媒体组件中存在漏洞。支持的版本中受影响的是 12.1.0.2。可轻松利用的漏洞允许具有创建会话权限和网络访问权限的低权限攻击者通过 Oracle Net 破坏 Oracle 多媒体组件。除攻击者以外的他人进行交互是实现成功攻击的必要条件。成功攻击此漏洞可导致接管 Oracle Multimedia (CVE-2016-10251)。

  - Oracle 数据库服务器的 Oracle Application Express 组件中存在漏洞。支持的版本中受影响的是低于 19.1 的版本。可轻松利用的漏洞允许未经身份验证的攻击者（可通过 HTTPS 进行网络访问）破坏 Oracle Application Express。除攻击者以外的他人进行交互是实现成功攻击的必要条件，尽管漏洞存在于 Oracle Application Express 中，但攻击也可能会严重影响其他产品。成功攻击此漏洞可导致在未经授权的情况下更新、插入或删除对某些 Oracle Application Express 可访问数据的访问权限，以及对 Oracle Application Express 可访问数据子集进行未经授权的读取访问 (CVE-2016-7103)。

  - Oracle 数据库服务器的 WLM (Apache Tomcat) 组件中存在漏洞。支持的版本中受影响的是 12.2.0.1、18c 和 19c。难以利用的漏洞允许未经身份验证的攻击者（可通过 HTTPS 进行网络访问）破坏 WLM (Apache Tomcat)。除攻击者以外的他人进行交互是实现成功攻击的必要条件。成功攻击此漏洞可导致接管 WLM (Apache Tomcat) (CVE-2019-17563)。

还受到其他漏洞的影响；参阅供应商公告，了解更多信息。

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号。

安全修复：在 JasPer 解码 JPEG 2000 图像文件的方式中发现多个缺陷。特制的文件可导致使用 JasPer 的应用程序崩溃或执行任意代码。(CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591) 在 JasPer 解码 JPEG 2000 图像文件的方式中发现多个缺陷。特别构建的文件可导致使用 JasPer 的应用程序崩溃。(CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

遠端 Oracle Database Server 缺少「2020 年 4 月重大修補程式更新 (CPU)」。因此受到多個弱點影響：
  - Oracle Database Server 的 Oracle Multimedia 元件中存在弱點。受影響的支援版本是 12.1.0.2。可輕鬆利用的弱點，允許擁有「建立工作階段」權限且可透過 Oracle Net 存取網路的低權限攻擊者入侵 Oracle Multimedia。若要成功攻擊，必須有攻擊者以外之他人的互動。成功攻擊此弱點可導致接管 Oracle Solaris (CVE-2016-10251)。

  - Oracle Database Server 的 Oracle Application Express 元件中存在弱點。受影響的支援版本早於 19.1。能夠透過 HTTPS 存取網路的未經驗證攻擊者可利用易受利用的弱點入侵 Oracle Application Express。若要成功攻擊，必須有攻擊者以外之他人的互動，且雖然弱點位於 Oracle Application Express 中，但攻擊可能對其他產品造成重大影響。成功攻擊此弱點可導致未經授權的更新、插入或刪除某些可供存取之 Oracle Application Express 資料的存取權，以及讀取可供存取之 Oracle Application Express 資料子集的存取權 (CVE-2016-7103)。

  - Oracle 資料庫伺服器的 WLM (Apache Tomcat) 元件中存在弱點。受影響的支援版本是 12.2.0.1、18c 和 19c。能夠透過 HTTPS 存取網路的未經驗證攻擊者可利用難以利用的弱點入侵 WLM (Apache Tomcat)。若要成功攻擊，必須有攻擊者以外之他人的互動。成功攻擊此弱點可導致接管 WLM (Apache Tomcat) (CVE-2019-17563)。

此產品也受到其他弱點影響；請參閱廠商公告以瞭解更多資訊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

安全性修正：在 JasPer 解碼 JPEG 2000 影像檔的方式中發現多個缺陷。特製檔案可造成使用 JasPer 的應用程式損毀，或可能執行任意程式碼。(CVE-2016-8654、CVE-2016-9560、CVE-2016-10249、CVE-2015-5203、CVE-2015-5221、CVE-2016-1577、CVE-2016-8690、CVE-2016-8693、CVE-2016-8884、CVE-2016-8885、CVE-2016-9262、CVE-2016-9591) 在 JasPer 解碼 JPEG 2000 影像檔的方式中發現多個缺陷。特製檔案可造成使用 JasPer 的應用程式損毀。(CVE-2016-1867、CVE-2016-2089、CVE-2016-2116、CVE-2016-8691、CVE-2016-8692、CVE-2016-8883、CVE-2016-9387、CVE-2016-9388、CVE-2016-9389、CVE-2016-9390、CVE-2016-9391、CVE-2016-9392、CVE-2016-9393、CVE-2016-9394、CVE-2016-9583、CVE-2016-9600、CVE-2016-10248、CVE-2016-10251)

The remote Oracle Database Server is missing the April 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:
  - Vulnerability in the Oracle Multimedia component of Oracle Database Server. The supported version that is     affected is 12.1.0.2. Easily exploitable vulnerability allows low privileged attacker having Create     Session privilege with network access via Oracle Net to compromise Oracle Multimedia. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability     can result in takeover of Oracle Multimedia (CVE-2016-10251).

  - Vulnerability in the Oracle Application Express component of Oracle Database Server. The supported   version that is affected is Prior to 19.1. Easily exploitable vulnerability allows unauthenticated attacker   with network access via HTTPS to compromise Oracle Application Express. Successful attacks require human   interaction from a person other than the attacker and while the vulnerability is in Oracle Application   Express, attacks may significantly impact additional products. Successful attacks of this vulnerability   can result in unauthorized update, insert or delete access to some of Oracle Application Express accessible   data as well as unauthorized read access to a subset of Oracle Application Express accessible data   (CVE-2016-7103).

  - Vulnerability in the WLM (Apache Tomcat) component of Oracle Database Server. Supported versions that   are affected are 12.2.0.1, 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker   with network access via HTTPS to compromise WLM (Apache Tomcat). Successful attacks require human   interaction from a person other than the attacker. Successful attacks of this vulnerability can result in   takeover of WLM (Apache Tomcat) (CVE-2019-17563).

It is also affected by additional vulnerabilities; see the vendor advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the way JasPer decoded     JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash or,     possibly, execute arbitrary code. (CVE-2016-8654,     CVE-2016-9560, CVE-2016-10249, CVE-2015-5203,     CVE-2015-5221, CVE-2016-1577, CVE-2016-8690,     CVE-2016-8693, CVE-2016-8884, CVE-2016-8885,     CVE-2016-9262, CVE-2016-9591)

  - Multiple flaws were found in the way JasPer decoded     JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash.
    (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116,     CVE-2016-8691, CVE-2016-8692, CVE-2016-8883,     CVE-2016-9387, CVE-2016-9388, CVE-2016-9389,     CVE-2016-9390, CVE-2016-9391, CVE-2016-9392,     CVE-2016-9393, CVE-2016-9394, CVE-2016-9583,     CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

Security Fix(es) :

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-8654, CVE-2016-9583, CVE-2016-9591, and CVE-2016-9600;
Gustavo Grieco for reporting CVE-2015-5203; and Josselin Feist for reporting CVE-2015-5221.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues: Security issues fixed :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec (bsc#1012530)

  - CVE-2016-9395: Missing sanity checks on the data in a     SIZ marker segment (bsc#1010977).

  - CVE-2016-9398: jpc_math.c:94: int jpc_floorlog2(int):
    Assertion 'x > 0' failed. (bsc#1010979)

  - CVE-2016-9560: stack-based buffer overflow in     jpc_tsfb_getbands2 (jpc_tsfb.c) (bsc#1011830)

  - CVE-2016-9583: Out of bounds heap read in     jpc_pi_nextpcrl() (bsc#1015400)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy (bsc#1015993)

  - CVE-2016-9600: NULL pointer Dereference due to missing     check for UNKNOWN color space in JP2 encoder     (bsc#1018088)

  - CVE-2016-10251: Use of uninitialized value in     jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

  - CVE-2017-5498: left-shift undefined behaviour     (bsc#1020353)

  - CVE-2017-6850: NULL pointer dereference in     jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9560, CVE-2016-9591, CVE-2016-9600, CVE-2016-10251

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
135585	Oracle Database 服务器多个漏洞（2020 年 4 月 CPU）	Nessus	Databases	4/15/2020	3/18/2024	high
100120	Scientific Linux 安全更新：SL6.x、SL7.x i386/x86_64　上的　jasper	Nessus	Scientific Linux Local Security Checks	5/11/2017	1/14/2021	high
135585	Oracle Database Server 多個弱點 (2020 年 4 月 CPU)	Nessus	Databases	4/15/2020	3/18/2024	high
100120	Scientific Linux 安全性更新：SL6.x、SL7.x i386/x86_64 上的 jasper	Nessus	Scientific Linux Local Security Checks	5/11/2017	1/14/2021	high
135585	Oracle Database Server Multiple Vulnerabilities (Apr 2020 CPU)	Nessus	Databases	4/15/2020	3/18/2024	high
100120	Scientific Linux Security Update : jasper on SL6.x, SL7.x i386/x86_64 (20170509)	Nessus	Scientific Linux Local Security Checks	5/11/2017	1/14/2021	high
100812	EulerOS 2.0 SP2 : jasper (EulerOS-SA-2017-1095)	Nessus	Huawei Local Security Checks	6/16/2017	1/6/2021	high
101464	Virtuozzo 6 : jasper / jasper-devel / jasper-libs / jasper-utils (VZLSA-2017-1208)	Nessus	Virtuozzo Local Security Checks	7/13/2017	1/4/2021	high
99232	SUSE SLES11 Security Update : jasper (SUSE-SU-2017:0946-1)	Nessus	SuSE Local Security Checks	4/6/2017	1/19/2021	high
100281	Fedora 24 : jasper (2017-da0b00fd64)	Nessus	Fedora Local Security Checks	5/19/2017	1/6/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high