[SECURITY] [DLA 101-1] jasper security update

2014-12-0612:45:21

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.457 Medium

EPSS

Percentile

97.4%

JSON

Package : jasper
Version : 1.900.1-7+squeeze2
CVE ID : CVE-2014-9029

Josh Duart of the Google Security Team discovered heap-based buffer
overflow flaws in JasPer, a library for manipulating JPEG-2000 files,
which could lead to denial of service (application crash) or the
execution of arbitrary code.

OSVersionArchitecturePackageVersionFilename
Debian6alllibjasper-dev< 1.900.1-7+squeeze2libjasper-dev_1.900.1-7+squeeze2_all.deb
Debian6alllibjasper-runtime< 1.900.1-7+squeeze2libjasper-runtime_1.900.1-7+squeeze2_all.deb
Debian6alljasper< 1.900.1-7+squeeze2jasper_1.900.1-7+squeeze2_all.deb
Debian6alllibjasper1< 1.900.1-7+squeeze2libjasper1_1.900.1-7+squeeze2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	libjasper-dev	< 1.900.1-7+squeeze2	libjasper-dev_1.900.1-7+squeeze2_all.deb
Debian	6	all	libjasper-runtime	< 1.900.1-7+squeeze2	libjasper-runtime_1.900.1-7+squeeze2_all.deb
Debian	6	all	jasper	< 1.900.1-7+squeeze2	jasper_1.900.1-7+squeeze2_all.deb
Debian	6	all	libjasper1	< 1.900.1-7+squeeze2	libjasper1_1.900.1-7+squeeze2_all.deb