Summary
Jose Duart of the Google Security Team
discovered a double free flaw (CVE-2014-8137) and a heap-based buffer overflow flaw (CVE-2014-8138) in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.
Solution
For the stable distribution (wheezy),
these problems have been fixed in version 1.900.1-13+deb7u2.
For the upcoming stable distribution (jessie) and the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your jasper packages.
Affected
jasper on Debian Linux
Detection
This check tests the installed software
version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-8137, CVE-2014-8138 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities