Gentoo FoundationGLSA-201503-01JasPer: Multiple Vulnerabilities
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.425 Medium
EPSS
Percentile
97.3%
Background
JasPer is a software-based implementation of the codec specified in the JPEG-2000 Part-1 standard.
Description
Multiple vulnerabilities have been discovered in JasPer. Please review the CVE identifiers referenced below for details.
Impact
A remote attacker could entice a user to open a specially crafted file using JasPer, possibly resulting in execution of arbitrary code.
Workaround
There is no known workaround at this time.
Resolution
All jasper users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/jasper-1.900.1-r9"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | media-libs/jasper | < 1.900.1-r9 | UNKNOWN |
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.425 Medium
EPSS
Percentile
97.3%