Vulnerability Name:

CVE-2008-3520 (CCN-45621)

Assigned:2008-09-08
Published:2008-09-08
Updated:2017-09-29
Summary:Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
CWE-190
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Gentoo Bugzilla Bug 222819
media-libs/jasper <1.900.1-r2 multiple vulnerabilities (CVE-2008-{3520,3521,3522})

Source: MISC
Type: Patch
http://bugs.gentoo.org/show_bug.cgi?id=222819

Source: MITRE
Type: CNA
CVE-2008-3520

Source: CCN
Type: RHSA-2009-0012
Moderate: netpbm security update

Source: REDHAT
Type: UNKNOWN
RHSA-2015:0698

Source: SECUNIA
Type: UNKNOWN
33173

Source: SECUNIA
Type: UNKNOWN
34391

Source: GENTOO
Type: UNKNOWN
GLSA-200812-18

Source: CCN
Type: ASA-2009-060
netpbm security update (RHSA-2009-0012)

Source: CCN
Type: JasPer Web page
The JasPer Project Home Page

Source: CCN
Type: GLSA-200812-18
JasPer: User-assisted execution of arbitrary code

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:142

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:144

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:164

Source: REDHAT
Type: UNKNOWN
RHSA-2009:0012

Source: BID
Type: Patch
31470

Source: CCN
Type: BID-31470
JasPer 1.900.1 Multiple Vulnerabilities

Source: SLACKWARE
Type: UNKNOWN
SSA:2015-302-02

Source: CCN
Type: USN-742-1
JasPer vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-742-1

Source: XF
Type: UNKNOWN
jasper-image-file-bo(45621)

Source: XF
Type: UNKNOWN
jasper-image-file-bo(45621)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10141

Vulnerable Configuration:Configuration 1:
  • cpe:/a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20083520
    V
    		CVE-2008-3520
    2017-09-27
    oval:org.mitre.oval:def:29253
    P
    		RHSA-2009:0012 -- netpbm security update (Moderate)
    2015-08-17
    oval:org.mitre.oval:def:13913
    P
    		USN-742-1 -- jasper vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:15133
    P
    		USN-1317-1 -- Ghostscript vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:22704
    P
    		ELSA-2009:0012: netpbm security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:10141
    V
    		Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
    2013-04-29
    oval:com.redhat.rhsa:def:20090012
    P
    		RHSA-2009:0012: netpbm security update (Moderate)
    2009-02-11
    BACK
    jasper_project jasper 1.900.1