[SECURITY] [DLA 121-1] jasper security update

2014-12-2218:45:30

lists.debian.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.233 Low

EPSS

Percentile

96.5%

JSON

Package : jasper
Version : 1.900.1-7+squeeze3
CVE ID : CVE-2014-8137 CVE-2014-8138

Jose Duart of the Google Security Team discovered a double free flaw
(CVE-2014-8137) and a heap-based buffer overflow flaw (CVE-2014-8138)
in JasPer, a library for manipulating JPEG-2000 files. A specially
crafted file could cause an application using JasPer to crash or,
possibly, execute arbitrary code.

OSVersionArchitecturePackageVersionFilename
Debian6alljasper< 1.900.1-7+squeeze3jasper_1.900.1-7+squeeze3_all.deb
Debian6alllibjasper-dev< 1.900.1-7+squeeze3libjasper-dev_1.900.1-7+squeeze3_all.deb
Debian6alllibjasper1< 1.900.1-7+squeeze3libjasper1_1.900.1-7+squeeze3_all.deb
Debian6alllibjasper-runtime< 1.900.1-7+squeeze3libjasper-runtime_1.900.1-7+squeeze3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	jasper	< 1.900.1-7+squeeze3	jasper_1.900.1-7+squeeze3_all.deb
Debian	6	all	libjasper-dev	< 1.900.1-7+squeeze3	libjasper-dev_1.900.1-7+squeeze3_all.deb
Debian	6	all	libjasper1	< 1.900.1-7+squeeze3	libjasper1_1.900.1-7+squeeze3_all.deb
Debian	6	all	libjasper-runtime	< 1.900.1-7+squeeze3	libjasper-runtime_1.900.1-7+squeeze3_all.deb