JasPer Library - Heap-based Buffer Overflow and Unrestricted Stack Memory Use
Summary
DSA-3138-1: jasper - security update. Affects jasper versions < 1.900.1-13+deb7u3. Fixed in 1.900.1-13+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The JasPer library is a software package used for manipulating JPEG-2000 files. It provides functionality for encoding, decoding, and manipulating images in the JPEG-2000 format. JasPer is widely used in various applications that handle image processing and storage. However, a vulnerability has been discovered in JasPer that could potentially allow an attacker to execute arbitrary code or crash an application using the library.
Vulnerability Detail
The vulnerability in JasPer consists of two separate flaws. The first flaw is an off-by-one error, leading to a heap-based buffer overflow (CVE-2014-8157). This means that a specially crafted file can cause a buffer overflow, potentially allowing an attacker to overwrite adjacent memory and execute arbitrary code. The second flaw is an unrestricted stack memory use (CVE-2014-8158), which can also be triggered by a specially crafted file. This flaw can lead to a crash or potentially allow an attacker to execute arbitrary code. Both vulnerabilities pose a significant risk to applications using JasPer.
How To Fix
Minimum fixed version
1.900.1-13+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jasperTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The JasPer library is vulnerable to a heap-based buffer overflow and an unrestricted stack memory use. These vulnerabilities can potentially allow an attacker to execute arbitrary code or crash an application using the library. It is crucial to upgrade to the patched version of JasPer (1.900.1-13+deb7u3) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jasper →
FAQ
JasPer is a library for manipulating JPEG-2000 files. It provides functionality for encoding, decoding, and manipulating images in the JPEG-2000 format.
The vulnerabilities in JasPer can allow an attacker to execute arbitrary code or crash an application using the library. This can lead to unauthorized access, data loss, or denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, and Vulert will analyze it for any open-source vulnerabilities, including the JasPer vulnerabilities.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to upgrade to the patched version of JasPer as soon as possible.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3138-1 at https://security-tracker.debian.org/tracker/CVE-2014-8157 and https://security-tracker.debian.org/tracker/CVE-2014-8158.
Related vulnerabilities
Recent vulnerabilities recorded for jasper.
