CVE-2014-8137
Fixed in a distro release EPSS 15%
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
Products: jasper_project jasper, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jasper | 1.900.5-1 |
| Debian 6.0 | jasper | 1.900.1-7+squeeze3 |
| Debian 7 | jasper | 1.900.1-13+deb7u2 |
| Red Hat Enterprise Linux 6 | jasper | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-debuginfo | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-devel | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-libs | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-utils | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.7-20150828.0.el6ev |
| Red Hat Enterprise Linux 6 | rhev-hypervisor7 | 0:7.1-20150827.1.el6ev |
| Red Hat Enterprise Linux 7 | jasper | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-debuginfo | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-devel | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-libs | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-utils | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | rhev-hypervisor7 | 0:7.1-20150827.1.el7ev |
| Red Hat rhev manager 3 | rhevm-spice-client | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-msi | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-msi | 0:3.5-3.el6 |
| Ubuntu 14.04 LTS | jasper | 1.900.1-14ubuntu3.2 |
| openSUSE Tumbleweed | jasper | 1.900.14-3.1 |