Skip to content
OpenAdvisories
High ELSA-2014-2021 3 CVEs

Important: jasper security update (Oracle Linux 7)

Published Dec 18, 2014 · Updated Dec 18, 2014

Ecosystem: Oracle Linux

Summary

[1.900.1-16.2]
- CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173566)
- CVE-2014-8138 - heap overflow in jp2_decode (#1173566)

[1.900.1-16.1]
- CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
marker segment decoders (#1171208)

[1.900.1-16]
- CERT VU#887409: heap buffer overflow flaws lead to arbitrary code execution
(#749150)

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 jasper 0:1.900.1-26.el7_0.2
Oracle Linux · 7 jasper-devel 0:1.900.1-26.el7_0.2
Oracle Linux · 7 jasper-libs 0:1.900.1-26.el7_0.2
Oracle Linux · 7 jasper-utils 0:1.900.1-26.el7_0.2

Vulnerabilities 3

  • Unscored —
    CVE-2014-8137 EPSS 15%

    Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers …

    jasper Ubuntu
  • Unscored —
    CVE-2014-8138 EPSS 19%

    Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a …

    jasper Ubuntu
  • Unscored —
    CVE-2014-9029 EPSS 18%

    Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in…

    jasper Ubuntu