Jasper - Double Free and Heap-based Buffer Overflow Vulnerabilities
Summary
DSA-3106-1: jasper - security update. Affects jasper versions < 1.900.1-13+deb7u2. Fixed in 1.900.1-13+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jasper is a library for manipulating JPEG-2000 files. It provides functionality for encoding, decoding, and manipulating images in the JPEG-2000 format. The library is commonly used in various applications that work with JPEG-2000 files. However, a vulnerability has been discovered in Jasper that could allow an attacker to crash an application or potentially execute arbitrary code.
Vulnerability Detail
The vulnerability in Jasper consists of two separate issues. The first is a double free flaw (CVE-2014-8137), which occurs when the library attempts to free memory that has already been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code. The second issue is a heap-based buffer overflow flaw (CVE-2014-8138), which occurs when the library writes data beyond the bounds of a buffer in the heap. This can also lead to memory corruption and potentially allow an attacker to execute arbitrary code. Both vulnerabilities can be triggered by a specially crafted JPEG-2000 file.
How To Fix
Minimum fixed version
1.900.1-13+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jasperTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerabilities in Jasper could allow an attacker to crash an application or execute arbitrary code. It is important to upgrade the jasper package to the patched version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jasper →
FAQ
Jasper is a library for manipulating JPEG-2000 files. It provides functionality for encoding, decoding, and manipulating images in the JPEG-2000 format.
A double free flaw occurs when a program attempts to free memory that has already been freed. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code.
A heap-based buffer overflow flaw occurs when a program writes data beyond the bounds of a buffer in the heap. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code.
The vulnerabilities can be exploited by a specially crafted JPEG-2000 file. When an application using Jasper processes this file, it can trigger the vulnerabilities and potentially allow an attacker to execute arbitrary code.
To fix the vulnerabilities, it is recommended to upgrade the jasper package to version 1.900.1-13+deb7u2 or later. This can be done by updating the package using the package manager of the operating system.
Related vulnerabilities
Recent vulnerabilities recorded for jasper.
