OpenSUSE Linux update for jasper



Published: 2019-05-03
Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2016-9396
CVE-2018-19539
CVE-2018-19542
CWE-ID CWE-617
CWE-399
CWE-476
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe 		Opensuse
Operating systems & Components / Operating system

Vendor SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Reachable Assertion

EUVDB-ID: #VU15698

Risk: Low

CVSSv3.1: 3.6 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2016-9396

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attacks.

The vulnerability exists due to reachable assertion in JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12. A remote attacker can perform a denial of service (DoS) attack via unspecified vectors.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.0

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Resource management error

EUVDB-ID: #VU18385

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2018-19539

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to access violation error within the jas_image_readcmpt() function in libjasper/base/jas_image.c. A remote attacker can create a specially crafted image, pass it to the application and trigger denial of service conditions.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.0

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU18386

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2018-19542

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in jp2_decode() function in libjasper/jp2/jp2_dec.c. A remote attacker can create a specially crafted image. pass it to hhe application and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages.

Vulnerable software versions

Opensuse: 15.0

CPE2.3 External links

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###