Bug 1396965 (CVE-2016-9390)

Summary: CVE-2016-9390 jasper: insufficient SIZ marker tilexoff and tileyoff checks
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abhgupta, bmcclain, cfergeau, dblechte, dmcphers, eedri, erik-fedora, jialiu, jokerman, jridky, kseifried, lmeyer, lsurette, mgoldboi, michal.skrivanek, mike, mmccomas, rbalakri, rdieter, rh-spice-bugs, rjones, sherold, slawomir, srevivo, tiwillia, ykaul, ylavi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: jasper 1.900.14 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-05-09 21:45:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1396986, 1396987, 1396988, 1396989, 1439171, 1439172, 1439173, 1439174    
Bug Blocks: 1314477    

Description Adam Mariš 2016-11-21 09:57:29 UTC
An assertion failure was found in jasper triggered when tiles lie outside of the image area.

Upstream patch:


CVE assignment:


Comment 1 Adam Mariš 2016-11-21 10:32:54 UTC
Created mingw-jasper tracking bugs for this issue:

Affects: fedora-all [bug 1396987]
Affects: epel-7 [bug 1396989]

Comment 2 Adam Mariš 2016-11-21 10:33:13 UTC
Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1396986]
Affects: epel-5 [bug 1396988]

Comment 3 Tomas Hoger 2017-03-02 22:54:57 UTC
This issue was reported upstream in:


It was first incorrectly fixed in version jasper 1.900.13 by protecting against integer overflows in jpc_dec_process_siz() - see CVE-2016-9387 / bug 1396959.  Re-fixed in version 1.900.14 using the fix linked to from comment 0.

The impact of this flaw seems to be limited to triggering an assertion failure in jas_seq2d_create() function.  Failed assertion causes program to exit unexpectedly, but does not allow code execution.  As a precaution against impacts other than the known assertion failure, it may get addressed in future jasper packages in Red Hat Enterprise Linux 6 and 7.

Comment 4 Tomas Hoger 2017-03-02 22:55:52 UTC
Original reporter's advisory:


Relevant info from the advisory:

Affected version:

imginfo: /tmp/portage/media-libs/jasper-1.900.13/work/jasper-1.900.13/src/libjasper/base/jas_seq.c:90: jas_matrix_t *jas_seq2d_create(int, int, int, int): Assertion `xstart <= xend && ystart <= yend' failed.

Commit fix:

Fixed version:



Comment 6 errata-xmlrpc 2017-05-09 17:19:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1208 https://access.redhat.com/errata/RHSA-2017:1208