Bug 1374337

Summary: openjpeg: Heap buffer overflow in opj_dwt_interleave_v in dwt.c
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dmoppert, erik-fedora, hobbes1069, jaromir.capik, manisandro, nforro, oliver, phracek, rdieter, slawomir
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20160908,reported=20160908,source=oss-security,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,cvss3=7.0/CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H,cwe=CWE-787,rhel-6/openjpeg=notaffected,rhel-7/openjpeg=notaffected,fedora-all/openjpeg=notaffected,fedora-all/openjpeg2=affected,fedora-all/mingw-openjpeg=notaffected,fedora-all/mingw-openjpeg2=affected,epel-all/openjpeg2=affected
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-20 00:11:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1374339, 1374340, 1374341, 1374342, 1374343    
Bug Blocks: 1374338    

Description Adam Mariš 2016-09-08 13:11:58 UTC
An out-of-bounds write was found in function opj_dwt_interleave_v of dwt.c

Upstream patch:

https://github.com/uclouvain/openjpeg/commit/e078172b1c3f98d2219c37076b238fb759c751ea

CVE request:

http://seclists.org/oss-sec/2016/q3/438

Comment 1 Adam Mariš 2016-09-08 13:16:48 UTC
Created openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1374339]

Comment 2 Adam Mariš 2016-09-08 13:16:56 UTC
Created mingw-openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1374341]

Comment 3 Adam Mariš 2016-09-08 13:17:03 UTC
Created openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1374340]
Affects: epel-all [bug 1374343]

Comment 4 Adam Mariš 2016-09-08 13:17:11 UTC
Created mingw-openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1374342]

Comment 5 Doran Moppert 2016-09-12 02:37:50 UTC
The same vulnerability was previously fixed in Chromium as CVE-2016-5157 (bug 1372218).

https://pdfium.googlesource.com/pdfium/+/b6befb2ed2485a3805cddea86dc7574510178ea9

Comment 6 Doran Moppert 2016-09-13 07:17:53 UTC
This issue does not appear to be present in openjpeg-1.x; only openjpeg2.

Upstream ticket:

https://github.com/uclouvain/openjpeg/issues/823

Comment 7 Fedora Update System 2016-09-13 22:21:01 UTC
openjpeg2-2.1.1-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2016-09-15 18:40:32 UTC
openjpeg2-2.1.1-3.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2016-09-18 02:19:39 UTC
mingw-openjpeg2-2.1.1-3.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2016-09-18 05:21:22 UTC
mingw-openjpeg2-2.1.1-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2016-09-18 05:21:43 UTC
openjpeg2-2.1.1-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2016-09-18 17:44:30 UTC
mingw-openjpeg2-2.1.1-3.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.