Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Ubuntu 14.10: 2483-1 Critical: JasPer Image Processing Issues

ubuntu
Calendar Grey January 26, 2015
Dist Ubuntu Esm H88
Explore the security flaws present in JasPer that impact Ubuntu environments and identify the critical patches required for improved protection.
JasPer could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

JasPer could be made to crash or run programs as your login if it

opened a specially crafted file.

Software Description:

- jasper: Library for manipulating JPEG-2000 files

Details:

Jose Duart discovered that JasPer incorrectly handled ICC color profiles in

JPEG-2000 image files. If a user were tricked into opening a specially

crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash

or possibly execute arbitrary code with user privileges. (CVE-2014-8137)

Jose Duart discovered that JasPer incorrectly decoded certain malformed

JPEG-2000 image files. If a user were tricked into opening a specially

crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash

or possibly execute arbitrary code with user privileges. (CVE-2014-8138)

It was discovered that JasPer incorrectly handled certain malformed

JPEG-2000 image files. If a user were tricked into opening a specially

crafted JPEG-2000 image file, a remote attacker could cause Ja...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical Ubuntu arbitrary code image processing jasper

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libjasper1                      1.900.1-debian1-2ubuntu0.2

Ubuntu 14.04 LTS:
  libjasper1                      1.900.1-14ubuntu3.2

Ubuntu 12.04 LTS:
  libjasper1                      1.900.1-13ubuntu0.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2483-1

CVE-2014-8137, CVE-2014-8138, CVE-2014-8157, CVE-2014-8158

Severity
critical
Lowest
Low
Medium
High
Critical

January 26, 2015

Topics%20covered

Topics Covered

security advisory critical Ubuntu arbitrary code image processing jasper

Package Information

https://launchpad.net/ubuntu/+source/jasper/1.900.1-debian1-2ubuntu0.2
https://launchpad.net/ubuntu/+source/jasper/1.900.1-14ubuntu3.2
https://launchpad.net/ubuntu/+source/jasper/1.900.1-13ubuntu0.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.