New jasper packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

oCERT reports :

The library is affected by a double-free vulnerability in function jas_iccattrval_destroy() as well as a heap-based buffer overflow in function jp2_decode(). A specially crafted jp2 file can be used to trigger the vulnerabilities.

oCERT reports :

The library is affected by an off-by-one error in a buffer boundary check in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to stack overflow. A specially crafted jp2 file can be used to trigger the vulnerabilities.

oCERT reports :

Multiple off-by-one flaws, leading to heap-based buffer overflows, were found in the way JasPer decoded JPEG 2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.

limingxing reports :

A vulnerability was found in the way the JasPer's jas_matrix_clip() function parses certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers     to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image,     which triggers a heap-based buffer overflow. (CVE-2014-8157)

Note that Nessus relies on the presence of the package as reported by the vendor.

Updated jasper packages that fix two security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8157)

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8158)

Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges pyddeh as the original reporter.

All JasPer users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All applications using the JasPer libraries must be restarted for the update to take effect.

An off-by-one flaw, leading to a heap-based buffer overflow (CVE-2014-8157 ), and an unrestricted stack memory use flaw (CVE-2014-8158 ) were found in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.

Fixes for CVE-2014-8157 and CVE-2014-8158

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes two security flaws in jasper.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8157)

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8158)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
86663	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : jasper (SSA:2015-302-02)	Nessus	Slackware Local Security Checks	2015/10/30	2021/1/14	critical
88875	FreeBSD : jasper -- multiple vulnerabilities (006e3b7c-d7d7-11e5-b85f-0018fe623f2b)	Nessus	FreeBSD Local Security Checks	2016/2/22	2021/1/4	medium
218638	Linux Distros Unpatched Vulnerability : CVE-2014-8157	Nessus	Misc.	2025/3/4	2026/1/28	critical
80969	CentOS 6 / 7 : jasper (CESA-2015:0074)	Nessus	CentOS Local Security Checks	2015/1/26	2021/1/4	high
80973	Debian DSA-3138-1 : jasper - security update	Nessus	Debian Local Security Checks	2015/1/26	2021/1/11	high
81133	Fedora 20 : mingw-jasper-1.900.1-26.fc20 (2015-1125)	Nessus	Fedora Local Security Checks	2015/2/3	2021/1/11	high
81212	Fedora 21 : jasper-1.900.1-30.fc21 (2015-1062)	Nessus	Fedora Local Security Checks	2015/2/9	2021/1/11	high
81325	Amazon Linux AMI : jasper (ALAS-2015-479)	Nessus	Amazon Linux Local Security Checks	2015/2/13	2018/4/18	high

検出

プラグインの検索

critical

medium

critical

high

high

high

high

high