CVE-2014-9029
Fixed in a distro release EPSS 18%
Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.
Products: jasper_project jasper
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jasper | 1.900.5-1 |
| Debian 6.0 | jasper | 1.900.1-7+squeeze2 |
| Debian 7 | jasper | 1.900.1-13+deb7u1 |
| Red Hat Enterprise Linux 6 | jasper | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-debuginfo | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-devel | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-libs | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 6 | jasper-utils | 0:1.900.1-16.el6_6.2 |
| Red Hat Enterprise Linux 7 | jasper | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-debuginfo | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-devel | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-libs | 0:1.900.1-26.el7_0.2 |
| Red Hat Enterprise Linux 7 | jasper-utils | 0:1.900.1-26.el7_0.2 |
| Red Hat rhev manager 3 | rhevm-spice-client | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-msi | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-msi | 0:3.5-3.el6 |
| Ubuntu 14.04 LTS | jasper | 1.900.1-14ubuntu3.1 |
| openSUSE Tumbleweed | jasper | 1.900.14-3.1 |