[SECURITY] [DLA 138-1] jasper security update

2015-01-2819:03:39

lists.debian.org

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.093 Low

EPSS

Percentile

94.7%

JSON

Package : jasper
Version : 1.900.1-7+squeeze4
CVE ID : CVE-2014-8157 CVE-2014-8158
Debian Bug : 775970

An off-by-one flaw, leading to a heap-based buffer overflow
(CVE-2014-8157), and an unrestricted stack memory use flaw
(CVE-2014-8158) were found in JasPer, a library for manipulating
JPEG-2000 files. A specially crafted file could cause an application
using JasPer to crash or, possibly, execute arbitrary code.

OSVersionArchitecturePackageVersionFilename
Debian7alljasper< 1.900.1-13+deb7u3jasper_1.900.1-13+deb7u3_all.deb
Debian7kfreebsd-amd64libjasper-dev< 1.900.1-13+deb7u3libjasper-dev_1.900.1-13+deb7u3_kfreebsd-amd64.deb
Debian7mipslibjasper-dev< 1.900.1-13+deb7u3libjasper-dev_1.900.1-13+deb7u3_mips.deb
Debian7armellibjasper-runtime< 1.900.1-13+deb7u3libjasper-runtime_1.900.1-13+deb7u3_armel.deb
Debian6amd64libjasper1< 1.900.1-7+squeeze4libjasper1_1.900.1-7+squeeze4_amd64.deb
Debian7kfreebsd-amd64libjasper-runtime< 1.900.1-13+deb7u3libjasper-runtime_1.900.1-13+deb7u3_kfreebsd-amd64.deb
Debian7i386libjasper-dev< 1.900.1-13+deb7u3libjasper-dev_1.900.1-13+deb7u3_i386.deb
Debian7s390libjasper-runtime< 1.900.1-13+deb7u3libjasper-runtime_1.900.1-13+deb7u3_s390.deb
Debian6alljasper< 1.900.1-7+squeeze4jasper_1.900.1-7+squeeze4_all.deb
Debian7kfreebsd-i386libjasper-dev< 1.900.1-13+deb7u3libjasper-dev_1.900.1-13+deb7u3_kfreebsd-i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	all	jasper	< 1.900.1-13+deb7u3	jasper_1.900.1-13+deb7u3_all.deb
Debian	7	kfreebsd-amd64	libjasper-dev	< 1.900.1-13+deb7u3	libjasper-dev_1.900.1-13+deb7u3_kfreebsd-amd64.deb
Debian	7	mips	libjasper-dev	< 1.900.1-13+deb7u3	libjasper-dev_1.900.1-13+deb7u3_mips.deb
Debian	7	armel	libjasper-runtime	< 1.900.1-13+deb7u3	libjasper-runtime_1.900.1-13+deb7u3_armel.deb
Debian	6	amd64	libjasper1	< 1.900.1-7+squeeze4	libjasper1_1.900.1-7+squeeze4_amd64.deb
Debian	7	kfreebsd-amd64	libjasper-runtime	< 1.900.1-13+deb7u3	libjasper-runtime_1.900.1-13+deb7u3_kfreebsd-amd64.deb
Debian	7	i386	libjasper-dev	< 1.900.1-13+deb7u3	libjasper-dev_1.900.1-13+deb7u3_i386.deb
Debian	7	s390	libjasper-runtime	< 1.900.1-13+deb7u3	libjasper-runtime_1.900.1-13+deb7u3_s390.deb
Debian	6	all	jasper	< 1.900.1-7+squeeze4	jasper_1.900.1-7+squeeze4_all.deb
Debian	7	kfreebsd-i386	libjasper-dev	< 1.900.1-13+deb7u3	libjasper-dev_1.900.1-13+deb7u3_kfreebsd-i386.deb