Bug 1298135 (CVE-2016-1867)

Summary: CVE-2016-1867 jasper: out-of-bounds read in jpc_pi_nextcprl()
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abhgupta, alonbl, bmcclain, carnil, cbuissar, cfergeau, dblechte, dmcphers, ecohen, erik-fedora, jialiu, jokerman, jpopelka, kseifried, lmeyer, lsurette, mgoldboi, michal.skrivanek, mike, mmccomas, rbalakri, rdieter, rh-spice-bugs, rjones, sherold, slawomir, tiwillia, yeylon, ykaul, ylavi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: jasper 1.900.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-05-09 21:41:57 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1298136, 1298137, 1298138, 1298139, 1439171, 1439172, 1439173, 1439174    
Bug Blocks: 1298141, 1314477    
Attachments:
Description Flags
print & return error on boundary check failure none

Description Andrej Nemec 2016-01-13 10:24:34 UTC 
A vulnerability was found in the way the JasPer's jpc_pi_nextcprl() function parses certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Report with the reproducer attached:
http://seclists.org/oss-sec/2016/q1/84
Comment 1 Andrej Nemec 2016-01-13 10:25:39 UTC 
Created mingw-jasper tracking bugs for this issue:

Affects: epel-7 [bug 1298137]
Affects: fedora-all [bug 1298139]
Comment 2 Andrej Nemec 2016-01-13 10:25:57 UTC 
Created jasper tracking bugs for this issue:

Affects: epel-5 [bug 1298136]
Affects: fedora-all [bug 1298138]
Comment 8 Fedora Update System 2016-08-15 21:21:22 UTC 
jasper-1.900.1-33.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2016-09-09 21:51:32 UTC 
jasper-1.900.1-33.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Comment 10 Tomas Hoger 2016-11-23 22:31:57 UTC 
Fix was integrated upstream in version 1.900.2:

https://github.com/mdadams/jasper/commit/980da43d8d388a67cac505e734423b2a5aa4cede
Comment 13 errata-xmlrpc 2017-05-09 17:15:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1208 https://access.redhat.com/errata/RHSA-2017:1208