Bug 1416061 (CVE-2017-5499)
| Summary: | CVE-2017-5499 jasper: Signed integer overflow in jpc_dequantize() in jpc_dec.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | bmcclain, cfergeau, dblechte, eedri, erik-fedora, jridky, lsurette, mgoldboi, michal.skrivanek, mike, mperina, rbalakri, rdieter, rh-spice-bugs, rjones, sbonazzo, sherold, slawomir, srevivo, tburke, ykaul, ylavi |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jasper 2.0.17 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in Jasper, where an integer overflow in libjasper/jpc/jpc_dec.c can lead to a denial of service, a remote attacker could exploit this flaw by persuading a victim to open a specially crafted file, causing the application to crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-14 13:48:06 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1449402 | ||
|
Description
Andrej Nemec
2017-01-24 13:58:54 UTC
Upstream bug report: https://github.com/mdadams/jasper/issues/63 This issue has not been resolved upstream yet (the current upstream version is 2.0.12). Reporter's advisory: https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/ Relevant information from the advisory: With the undefined behavior sanitizer enabled, jasper crashes showing some left shift and some signed integer overflow. ... Affected version / Tested on: 1.900.17 Fixed version: N/A Commit fix: N/A Relevant part of the stacktrace: # imginfo -f $FILE /tmp/portage/media-libs/jasper-1.900.17/work/jasper-1.900.17/src/libjasper/jpc/jpc_dec.c:1838:9: runtime error: signed integer overflow: -64356352 * 6359082673847140352 cannot be represented in type 'long' CVE: CVE-2017-5499 The important information form the advisory is that this crash only occurs when jasper is compiles with undefined behaviour sanitizer (ubsan) enabled. That is a development tool aimed to identify possible code bugs related to undefined behaviour. There is no crash as described by this CVE in builds not using ubsan. Upstream commit: https://github.com/jasper-software/jasper/commit/8c4e99592e7da53a9de2934bc7781535d0e0595d Fixed upstream in jasper 2.0.17. |