Bug 1416064 (CVE-2017-5501)
Summary: | CVE-2017-5501 jasper: Signed integer overflow in jpc_tsfb_getbands2() in jpc_tsfb.c | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED NOTABUG | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | bmcclain, cfergeau, dblechte, eedri, erik-fedora, jridky, lsurette, mgoldboi, michal.skrivanek, mike, rbalakri, rdieter, rh-spice-bugs, rjones, sherold, slawomir, srevivo, ykaul, ylavi |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2017-03-13 22:15:18 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 1449402 |
Description
Andrej Nemec
2017-01-24 14:02:23 UTC
Created mingw-jasper tracking bugs for this issue: Affects: epel-7 [bug 1406409] Created jasper tracking bugs for this issue: Affects: epel-5 [bug 1406406] Upstream bug report: https://github.com/mdadams/jasper/issues/70 This issue has not been resolved upstream yet (the current upstream version is 2.0.12). Reporter's advisory: https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/ Relevant information from the advisory: With the undefined behavior sanitizer enabled, jasper crashes showing some left shift and some signed integer overflow. ... Affected version / Tested on: 1.900.17 Fixed version: N/A Commit fix: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00022-jasper-signedintoverflow-jpc_tsfb_c Relevant part of the stacktrace: # imginfo -f $FILE /tmp/portage/media-libs/jasper-1.900.17/work/jasper-1.900.17/src/libjasper/jpc/jpc_tsfb.c:233:35: runtime error: signed integer overflow: 2013306369 + 251691968 cannot be represented in type 'int' CVE: CVE-2017-5501 The important information form the advisory is that this crash only occurs when jasper is compiles with undefined behaviour sanitizer (ubsan) enabled. That is a development tool aimed to identify possible code bugs related to undefined behaviour. There is no crash as described by this CVE in builds not using ubsan. |