Summary
An off-by-one flaw,
leading to a heap-based buffer overflow (CVE-2014-8157), and an unrestricted stack memory use flaw (CVE-2014-8158) were found in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.
Solution
For the stable distribution (wheezy),
these problems have been fixed in version 1.900.1-13+deb7u3.
For the upcoming stable distribution (jessie) and the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your jasper packages.
Affected
jasper on Debian Linux
Detection
This check tests the installed software version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2014-8157, CVE-2014-8158 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities