CVE-2014-9029
HighSummary
Multiple off-by-one errors in the jpc_dec_cp_setfromcox and jpc_dec_cp_setfromrgn functions in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, leading to a heap-based buffer overflow.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to upgrade to the latest version of JasPer to mitigate this vulnerability and to monitor systems for suspicious activity related to jp2 files.
Other vulnerabilities in JasPer 1.900.1 i wcześniejsze
See all- CVE-2016-1577High
A double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
- CVE-2014-8138High
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
Original NVD description (English source)
Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.