Bug 1311126 (CVE-2016-1951)

Summary:	CVE-2016-1951 nspr: Memory allocation issue related to PR_*printf functions
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	sardella, security-response-team, slawomir
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nspr 4.12	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:48:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1311127

Description Adam Mariš 2016-02-23 12:56:55 UTC

It was reported that unspecified memory allocation bug related to PR_*printf functions was fixed in nspr 4.12.

External Reference:

https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/dV4MyMsg6jw

Comment 1 Huzaifa S. Sidhpurwala 2016-03-14 05:17:55 UTC

Upstream bug report:

https://bugzilla.mozilla.org/show_bug.cgi?id=1174015

Upstream commit:

https://hg.mozilla.org/projects/nspr/rev/96381e3aaae2

Comment 2 Huzaifa S. Sidhpurwala 2016-06-10 05:23:11 UTC

This issue was fixed in nspr-4.12

Fedora 22 and Fedora 23 currently ship nspr-4.12 and therefore is not affected by this flaw.

Comment 4 Martin Prpič 2016-08-29 11:56:23 UTC

This issue will be fixed in the next nspr rebase in minor versions of RHEL 6 and 7.

Comment 5 Huzaifa S. Sidhpurwala 2016-10-21 08:50:05 UTC

Analysis:

There is an integer overflow followed by a heap-buffer overflow in the functions PR_vsmprintf() and PR_vsprintf_append(). Both of these functions internally use GrowStuff() which uses 32-bit integers to calculate string sizes which results in overflow at different places depending on 32-bit or 64-bit architecture. 

Applications compiled against NSS library, in which very large untrusted  strings are passed to the above functions are vulnerable to this flaw.