CVE-2014-8157

CWE-189CWE-193CWE-122 — Heap-based Buffer Overflow12 documents7 sources
Severity
7.5HIGH
EPSS
5.8%
top 9.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Jasper Project JasperDebian Debian LinuxOpensuse Opensuse+1 more
Timeline
PublishedJan 26
Latest updateMay 14

Description

Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶Ubuntujasper< 1.900.1-14ubuntu3.2
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Debian Linux 7.0, Enterprise Linux 6.0, 7.0

🔴Vulnerability Details

3
GHSA
GHSA-h547-hw4v-2v53: Off-by-one error in the jpc_dec_process_sot function in JasPer 1↗2022-05-14
▶
CVEList
CVE-2014-8157: Off-by-one error in the jpc_dec_process_sot function in JasPer 1↗2015-01-26
▶
OSV
CVE-2014-8157: Off-by-one error in the jpc_dec_process_sot function in JasPer 1↗2015-01-22
▶

📋Vendor Advisories

3
Ubuntu
Ghostscript vulnerabilities↗2015-01-26
▶
Ubuntu
JasPer vulnerabilities↗2015-01-26
▶
Red Hat
jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)↗2015-01-21
▶

💬Community

5
Bugzilla
CVE-2014-8157 CVE-2014-8158 mingw-jasper: various flaws [fedora-all]↗2015-01-22
▶
Bugzilla
CVE-2014-8157 CVE-2014-8158 mingw-jasper: various flaws [epel-7]↗2015-01-22
▶
Bugzilla
CVE-2014-8157 CVE-2014-8158 jasper: various flaws [fedora-all]↗2015-01-22
▶
Bugzilla
CVE-2014-8157 CVE-2014-8158 jasper: various flaws [epel-5]↗2015-01-22
▶
Bugzilla
CVE-2014-8157 jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)↗2015-01-06
▶
CVE-2014-8157 (HIGH CVSS 7.5) | Off-by-one error in the jpc_dec_pro | cvebase.io