CVE-2014-8138
Fixed in a distro release EPSS 19%
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
Products: redhat enterprise_linux, jasper_project jasper
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jasper | 1.900.5-1 |
| Debian 6.0 | jasper | 1.900.1-7+squeeze3 |
| Debian 7 | jasper | 1.900.1-13+deb7u2 |
| Red Hat Enterprise Linux 6 | jasper | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-debuginfo | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-devel | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-libs | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-utils | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.7-20150828.0.el6ev |
| Red Hat Enterprise Linux 6 | rhev-hypervisor7 | 0:7.1-20150827.1.el6ev |
| Red Hat Enterprise Linux 7 | jasper | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-debuginfo | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-devel | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-libs | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-utils | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | rhev-hypervisor7 | 0:7.1-20150827.1.el7ev |
| Red Hat rhev manager 3 | rhevm-spice-client | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-msi | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-msi | 0:3.5-3.el6 |
| Ubuntu 14.04 LTS | jasper | 1.900.1-14ubuntu3.2 |
| openSUSE Tumbleweed | jasper | 1.900.14-3.1 |