CVSS: 6.8EPSS: 15%CPEs: 3EXPL: 0CVE-2014-8137 – jasper: double-free in in jas_iccattrval_destroy() (oCERT-2014-012)
https://notcve.org/view.php?id=CVE-2014-8137
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file. Doble vulnerabilidad de liberación en la función jas_iccattrval_destroy en JasPer 1.900.1 y anteriores permite a atacantes remotos causar una denegación de servicio (caída) o la posibilidad de ejecutar código arbitrario a través del perfil de color ICC modificado en un archivo de imagen JPEG 2000 A double free flaw was found in the way JasPer parsed ICC color profiles in JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. • http://advisories.mageia.org/MGASA-2014-0539.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00013.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00014.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00017.html http://packetstormsecurity.com/files/129660/JasPer-1.900.1-Double-Free-Heap-Overflow.html http://rhn.redhat.com/errata/RHSA-2014-2021.html http://rhn.redhat.com/errata/RHSA-2015-0698.html http://rhn.redhat.com/errata/RHSA-2015-1713.html htt • CWE-416: Use After Free •
CVSS: 7.5EPSS: 42%CPEs: 1EXPL: 0CVE-2014-9029 – jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)
https://notcve.org/view.php?id=CVE-2014-9029
Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow. Múltiples errores de superación de límite (off-by-one) en las funciones (1) jpc_dec_cp_setfromcox y (2) jpc_dec_cp_setfromrgn en jpc/jpc_dec.c en JasPer 1.900.1 y anteriores permiten a atacantes remotos ejecutar código arbitrario a través de un fichero jp2 manipulado, lo que provoca un desbordamiento de buffer basado en memoria dinámica. Multiple off-by-one flaws, leading to heap-based buffer overflows, were found in the way JasPer decoded JPEG 2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. • http://advisories.mageia.org/MGASA-2014-0514.html http://packetstormsecurity.com/files/129393/JasPer-1.900.1-Buffer-Overflow.html http://rhn.redhat.com/errata/RHSA-2014-2021.html http://rhn.redhat.com/errata/RHSA-2015-0698.html http://secunia.com/advisories/61747 http://secunia.com/advisories/62828 http://www.debian.org/security/2014/dsa-3089 http://www.mandriva.com/security/advisories?name=MDVSA-2014:247 http://www.mandriva.com/security/advisories?name=MDVSA-2015:159 http:/ • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 19%CPEs: 15EXPL: 0CVE-2011-4517 – jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)
https://notcve.org/view.php?id=CVE-2011-4517
The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file. La función jpc_crg_getparms de libjasper/jpc/jpc_cs.c de JasPer 1.900.1 utiliza un tipo de datos incorrecto durante un cálculo determinado de tamaño, lo que permite a atacantes remotos provocar un desbordamiento de buffer de memoria dinámica y ejecutar código arbitrario, o provocar una denegación de servicio (corrupción de memoria dinámica), a través de un archivo JPEG2000 mal formado. A heap-based buffer overflow flaw was found in the way JasPer decoded JPEG 2000 compressed image files. An attacker could create a malicious JPEG 2000 compressed image file that, when opened, would cause applications that use JasPer (such as Nautilus) to crash or, potentially, execute arbitrary code. • http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html http://osvdb.org/77596 http://rhn.redhat.com/errata/RHSA-2015-0698.html http://secunia.com/advisories/47193 http://secunia.com/advisories/47306 http://secunia.com/advisories/47353 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 http://www • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.8EPSS: 10%CPEs: 14EXPL: 0CVE-2011-4516 – jasper: heap buffer overflow flaws lead to arbitrary code execution (CERT VU#887409)
https://notcve.org/view.php?id=CVE-2011-4516
Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file. Desbordamiento de buffer de memoria dinámica en la función jpc_cox_getcompparms de libjasper/jpc/jpc_cs.c de JasPer 1.900.1 permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un valor numrlvls de un archivo JPEG2000. A heap-based buffer overflow flaw was found in the way JasPer decoded JPEG 2000 compressed image files. An attacker could create a malicious JPEG 2000 compressed image file that, when opened, would cause applications that use JasPer (such as Nautilus) to crash or, potentially, execute arbitrary code. • http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html http://osvdb.org/77595 http://rhn.redhat.com/errata/RHSA-2015-0698.html http://secunia.com/advisories/47193 http://secunia.com/advisories/47306 http://secunia.com/advisories/47353 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 http://www • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2008-3521
https://notcve.org/view.php?id=CVE-2008-3521
Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion. La función jas_stream_tmpfile de libjasper/base/jas_stream.c en JasPer v1.900.1 permite a usuarios locales sobrescribir ficheros de su elección a través de un ataque symlink en un fichero temporal tmp.XXXXXXXXXX. • http://bugs.gentoo.org/attachment.cgi?id=163282&action=view http://bugs.gentoo.org/show_bug.cgi?id=222819 http://secunia.com/advisories/34391 http://www.mandriva.com/security/advisories?name=MDVSA-2009:142 http://www.mandriva.com/security/advisories?name=MDVSA-2009:164 http://www.securityfocus.com/bid/31470 http://www.ubuntu.com/usn/USN-742-1 https://bugzilla.redhat.com/show_bug.cgi? • CWE-59: Improper Link Resolution Before File Access ('Link Following') •