Bug 1396971 (CVE-2016-9392, CVE-2016-9393, CVE-2016-9394)
| Summary: | CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 jasper: insufficient SIZ marker segment data sanity checks | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | abhgupta, bmcclain, cfergeau, dblechte, dmcphers, eedri, erik-fedora, jialiu, jokerman, jridky, kseifried, lmeyer, lsurette, mgoldboi, michal.skrivanek, mike, mmccomas, rbalakri, rdieter, rh-spice-bugs, rjones, sherold, slawomir, srevivo, tiwillia, ykaul, ylavi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jasper 1.900.17 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-05-09 21:41:43 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1396986, 1396987, 1396988, 1396989, 1439171, 1439172, 1439173, 1439174 | ||
| Bug Blocks: | 1314477 | ||
|
Description
Adam Mariš
2016-11-21 10:06:28 UTC
Created mingw-jasper tracking bugs for this issue: Affects: fedora-all [bug 1396987] Affects: epel-7 [bug 1396989] Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1396986] Affects: epel-5 [bug 1396988] This fix further extends checks added for CVE-2016-9390 (bug 1396965). There are 3 CVEs for various symptoms of issues addressed by this fix. All 3 CVEs are covered by this advisory from the original reporter: https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure/ * CVE-2016-9392 Upstream bug report: https://github.com/mdadams/jasper/issues/57 Relevant information from the original reporter's advisory: Affected version: 1.900.13 Output/failure: imginfo: /tmp/portage/media-libs/jasper-1.900.13/work/jasper-1.900.13/src/libjasper/jpc/jpc_dec.c:1637: void calcstepsizes(uint_fast16_t, int, uint_fast16_t *): Assertion `!((expn + (numrlvls – 1) – (numrlvls – 1 – ((bandno > 0) ? ((bandno + 2) / 3) : (0)))) & (~0x1f))’ failed. Commit fix: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 Fixed version: 1.900.17 Testcase: https://github.com/asarubbo/poc/blob/master/00012-jasper-assert-calcstepsizes CVE: CVE-2016-9392 * CVE-2016-9393 Affected version: 1.900.13 Output/failure: type = 0xff41 (UNKNOWN); len = 20;02 40 40 00 00 00 00 ee ff 00 00 00 00 24 00 00 00 00 imginfo: /tmp/portage/media-libs/jasper-1.900.13/work/jasper-1.900.13/src/libjasper/jpc/jpc_t2cod.c:297: int jpc_pi_nextrpcl(jpc_pi_t *): Assertion `pi->prcno pirlvl->numprcs’ failed. Commit fix: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 Fixed version: 1.900.17 Testcase: https://github.com/asarubbo/poc/blob/master/00013-jasper-assert-jpc_pi_nextrpcl CVE: CVE-2016-9393 * CVE-2016-9394 Affected version: 1.900.15 Output/failure: imginfo: /tmp/portage/media-libs/jasper-1.900.15/work/jasper-1.900.15/src/libjasper/base/jas_seq.c:90: jas_matrix_t *jas_seq2d_create(int, int, int, int): Assertion `xstart <= xend && ystart <= yend' failed. Commit fix: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 Fixed version: 1.900.17 Testcase: https://github.com/asarubbo/poc/blob/master/00016-jasper-assert-jas_matrix_t CVE: CVE-2016-9394 Similar to the CVE-2016-9390 issue, the impact of this flaw seems to be limited to triggering various assertion failures. Failed assertion causes program to exit unexpectedly, but does not allow code execution. As a precaution against impacts other than the known assertion failures, it may get addressed in future jasper packages in Red Hat Enterprise Linux 6 and 7. *** Bug 1396972 has been marked as a duplicate of this bug. *** *** Bug 1396975 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2017:1208 https://access.redhat.com/errata/RHSA-2017:1208 |