Every CVE Search/ Get API key

CVE-2014-9029

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn...

7.5 HighFix available

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Exploit likelihood

18.2%Up 5.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Record
CVE-2014-9029
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-189
Updated
2026-11-02
CVE List No score

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Record
CVE-2014-9029
Updated
2026-11-02
EUVDEUVD-2014-8857 No score

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Record
EUVD-2014-8857
Updated
2026-11-03
GitHub AdvisoriesGHSA-w26c-gw69-r33c No score

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn...

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Record
GHSA-w26c-gw69-r33c
Updated
2026-11-02
OSVMGASA-2014-0514 No score

Updated jasper packages fix CVE-2014-9029

Updated jasper packages fix security vulnerability:

Josh Duart of the Google Security Team discovered heap-based buffer overflow flaws in JasPer, which could lead to denial of service (application crash) or the execution of arbitrary code (CVE-2014-9029).

Record
MGASA-2014-0514
Updated
2026-11-02
OSVopenSUSE-SU-2024:10281-1 No score

jasper-1.900.14-3.1 on GA media

These are all security issues fixed in the jasper-1.900.14-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10281-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9029 No score

Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.

Record
UBUNTU-CVE-2014-9029
Updated
2026-11-02
OSVUSN-2434-1 No score

jasper vulnerability

Jose Duart discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code with user privileges.

Record
USN-2434-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jasper
Debian:6.0
 before 1.900.1-7+squeeze2, plus listed versions
1.900.1-71.900.1-7+squeeze1
1.900.1-7+squeeze2
jasper
Debian:7
 before 1.900.1-13+deb7u1, plus listed versions
1.900.1-13
1.900.1-13+deb7u1
jasper
Mageia:4
 before 1.900.1-15.1.mga4
1.900.1-15.1.mga4
jasper
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-utils
Red Hat:enterprise_linux:6::client
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
Show 40 moreShow less
Affected packages
PackageAffectedFixed
jasper-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-utils
Red Hat:enterprise_linux:6::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-utils
Red Hat:enterprise_linux:6::server
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper-utils
Red Hat:enterprise_linux:6::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-16.el6_6.2
0:1.900.1-16.el6_6.2
jasper
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-libs
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-utils
Red Hat:enterprise_linux:7::client
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-libs
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-utils
Red Hat:enterprise_linux:7::computenode
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-libs
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-utils
Red Hat:enterprise_linux:7::server
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-libs
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
jasper-utils
Red Hat:enterprise_linux:7::workstation
From an advisory covering 3 CVEs
 before 0:1.900.1-26.el7_0.2
0:1.900.1-26.el7_0.2
rhevm-spice-client
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x64-cab
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x64-msi
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x86-cab
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x86-msi
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
jasper
Ubuntu:14.04:LTS
 before 1.900.1-14ubuntu3.1, plus listed versions
1.900.1-141.900.1-14ubuntu3
1.900.1-14ubuntu3.1
jasper
openSUSE:Tumbleweed
From an advisory covering 30 CVEs
 before 1.900.14-3.1
1.900.14-3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9029 is a high vulnerability (CVSS 7.5) in Jasper Project Jasper, published December 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 18.2%, the 97th percentile. Fixed in jasper 1.900.1-7+squeeze2.

References

Show 91 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open