CVE-2014-8157

Vulnerability

An off-by-one error exists in the jpc_dec_process_sot function of JasPer versions 1.900.1 and earlier. The flaw occurs when processing a crafted JPEG-2000 image, triggering a heap-based buffer overflow. This affects the JasPer library, which is used by various applications, including Ghostscript and the Red Hat Enterprise Virtualization Manager SPICE client [1][2][3][4].

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted JPEG-2000 image file to a target application that uses the vulnerable JasPer library. No authentication is required; the attack can be delivered remotely via user interaction (e.g., opening a malicious image file) or by tricking a service into processing the file. The off-by-one error leads to writing one element beyond the allocated heap buffer [1][2].

Impact

Successful exploitation could cause a denial of service (application crash) or potentially allow arbitrary code execution with the privileges of the user running the application. For example, in the context of a browser or image viewer, code execution could lead to full compromise of the user's session [1][2][4].

Mitigation

Fixed versions are available: for Red Hat Enterprise Linux 7, jasper-1.900.1-26.el7_0.3 [1]; for Red Hat Enterprise Linux 6, jasper-1.900.1-16.el6_6.3 [1]; for Ubuntu, versions correcting CVE-2014-8157 as part of USN-2483-1 [2]; and for Ghostscript, USN-2483-2 [3]. Users should update to the latest package. There is no known workaround; the vulnerability is addressed by applying the vendor patch [1][2][3].