CVE-2014-8157
Fixed in a distro release EPSS 17%
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
Products: opensuse, debian_linux, redhat enterprise_linux, jasper_project jasper
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jasper | 1.900.5-1 |
| Debian 6.0 | jasper | 1.900.1-7+squeeze4 |
| Debian 7 | jasper | 1.900.1-13+deb7u3 |
| Red Hat Enterprise Linux 6 | jasper | 0:1.900.1-16.el6_6.3 |
| Red Hat Enterprise Linux 6 | jasper-debuginfo | 0:1.900.1-16.el6_6.3 |
| Red Hat Enterprise Linux 6 | jasper-devel | 0:1.900.1-16.el6_6.3 |
| Red Hat Enterprise Linux 6 | jasper-libs | 0:1.900.1-16.el6_6.3 |
| Red Hat Enterprise Linux 6 | jasper-utils | 0:1.900.1-16.el6_6.3 |
| Red Hat Enterprise Linux 7 | jasper | 0:1.900.1-26.el7_0.3 |
| Red Hat Enterprise Linux 7 | jasper-debuginfo | 0:1.900.1-26.el7_0.3 |
| Red Hat Enterprise Linux 7 | jasper-devel | 0:1.900.1-26.el7_0.3 |
| Red Hat Enterprise Linux 7 | jasper-libs | 0:1.900.1-26.el7_0.3 |
| Red Hat Enterprise Linux 7 | jasper-utils | 0:1.900.1-26.el7_0.3 |
| Red Hat rhev manager 3 | rhevm-spice-client | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-msi | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-msi | 0:3.5-3.el6 |
| SUSE Linux Enterprise Desktop 12 | jasper | 1.900.1-170.1 |
| SUSE Linux Enterprise Server 12 | jasper | 1.900.1-170.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | jasper | 1.900.1-170.1 |
| SUSE Linux Enterprise Software Development Kit 12 | jasper | 1.900.1-170.1 |
| Ubuntu 14.04 LTS | jasper | 1.900.1-14ubuntu3.2 |
| openSUSE Tumbleweed | jasper | 1.900.14-3.1 |