CVE-2014-8138
NoneCVSS
—
EPSS
18.5%
Published
Dec 24, 2014
CISA due date
—
The record
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:6.0 | jasper | 0 | 1.900.1-7+squeeze3 |
| Debian:7 | jasper | 0 | 1.900.1-13+deb7u2 |
| Mageia:4 | jasper | 0 | 1.900.1-15.2.mga4 |
| Red Hat:enterprise_linux:6::client | jasper | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::client | jasper-debuginfo | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::client | jasper-devel | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::client | jasper-libs | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::client | jasper-utils | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::computenode | jasper | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::computenode | jasper-debuginfo | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::computenode | jasper-devel | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::computenode | jasper-libs | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::computenode | jasper-utils | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::hypervisor | rhev-hypervisor6 | 0 | 0:6.7-20150828.0.el6ev |
| Red Hat:enterprise_linux:6::hypervisor | rhev-hypervisor7 | 0 | 0:7.1-20150827.1.el6ev |
| Red Hat:enterprise_linux:6::server | jasper | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::server | jasper-debuginfo | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::server | jasper-devel | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::server | jasper-libs | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::server | jasper-utils | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::workstation | jasper | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::workstation | jasper-debuginfo | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::workstation | jasper-devel | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::workstation | jasper-libs | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:6::workstation | jasper-utils | 0 | 0:1.900.1-16.el6_6.2 |
| Red Hat:enterprise_linux:7::client | jasper | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::client | jasper-debuginfo | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::client | jasper-devel | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::client | jasper-libs | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::client | jasper-utils | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::computenode | jasper | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::computenode | jasper-debuginfo | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::computenode | jasper-devel | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::computenode | jasper-libs | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::computenode | jasper-utils | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::hypervisor | rhev-hypervisor7 | 0 | 0:7.1-20150827.1.el7ev |
| Red Hat:enterprise_linux:7::server | jasper | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::server | jasper-debuginfo | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::server | jasper-devel | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::server | jasper-libs | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::server | jasper-utils | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::workstation | jasper | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::workstation | jasper-debuginfo | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::workstation | jasper-devel | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::workstation | jasper-libs | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:enterprise_linux:7::workstation | jasper-utils | 0 | 0:1.900.1-26.el7_0.2 |
| Red Hat:rhev_manager:3 | rhevm-spice-client | 0 | 0:3.5-3.el6 |
| Red Hat:rhev_manager:3 | rhevm-spice-client-x64-cab | 0 | 0:3.5-3.el6 |
| Red Hat:rhev_manager:3 | rhevm-spice-client-x64-msi | 0 | 0:3.5-3.el6 |
| Red Hat:rhev_manager:3 | rhevm-spice-client-x86-cab | 0 | 0:3.5-3.el6 |
| Red Hat:rhev_manager:3 | rhevm-spice-client-x86-msi | 0 | 0:3.5-3.el6 |
| Ubuntu:14.04:LTS | jasper | 0 | 1.900.1-14ubuntu3.2 |
| openSUSE:Tumbleweed | jasper | 0 | 1.900.14-3.1 |
Related vulnerabilities
- CVE-2014-8158 Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow… Also affects jasper
- CVE-2014-8157 Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows… Also affects jasper
- CVE-2014-8137 Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and… Also affects jasper
- CVE-2014-9029 Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn… Also affects jasper
- CVE-2011-4516 Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c… Also affects jasper
- CVE-2011-4517 The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an… Also affects jasper
- CVE-2016-10249 Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before… Also affects jasper
- CVE-2016-1577 Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and… Also affects jasper