PT-2014-8427 · Jasper+5 · Jasper+5

Jose Duart

·

Publicado

2014-12-18

·

Atualizado

2024-06-15

·

CVE-2014-8137

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions JasPer versions 1.900.1 and earlier
Description The issue is related to a double free vulnerability in the jas iccattrval destroy function. This vulnerability allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
Recommendations For JasPer versions 1.900.1 and earlier, as a temporary workaround, consider disabling the use of ICC color profiles in JPEG 2000 image files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

ALT-PU-2016-2474
CESA-2014_2021
CVE-2014-8137
DLA-121-1
DSA-3106-1
MGASA-2014-0539
OPENSUSE-SU-2024:10281-1
RHSA-2014:2021
RHSA-2014_2021
RHSA-2015:0698
RHSA-2015:1713
SUSE-SU-2015_0016-1
SUSE-SU-2015_0258-1
USN-2483-1
USN-2483-2

Produtos afetados

Alt Linux
Centos
Jasper
Red Hat
Suse
Ubuntu