Jasper · Jasper · CVE-2014-8137
**Name of the Vulnerable Software and Affected Versions**
JasPer versions 1.900.1 and earlier
**Description**
The issue is related to a double free vulnerability in the `jas iccattrval destroy` function. This vulnerability allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
**Recommendations**
For JasPer versions 1.900.1 and earlier, as a temporary workaround, consider disabling the use of ICC color profiles in JPEG 2000 image files until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.