Bug 1434442

Summary:	CVE-2016-10249 jasper: Out-of-bounds heap read in jpc_dec_tiledecode
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, bmcclain, cfergeau, dblechte, eedri, erik-fedora, jridky, kseifried, lsurette, mgoldboi, michal.skrivanek, mike, rbalakri, rdieter, rh-spice-bugs, rjones, sherold, srevivo, tiwillia, ykaul, ylavi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	jasper 1.900.12	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-24 14:00:35 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1434464, 1434465, 1434466, 1434467
Bug Blocks:	1314477

Description Adam Mariš 2017-03-21 14:04:23 UTC

An integer overflow in jas_matrix_create resulting into OOB heap read in jpc_dec_tiledecode was found.

Upstream patch:

https://github.com/mdadams/jasper/commit/988f8365f7d8ad8073b6786e433d34c553ecf568

Published on oss-sec:

http://seclists.org/oss-sec/2017/q1/607

Reference:

https://blogs.gentoo.org/ago/2016/10/23/jasper-heap-based-buffer-overflow-in-jpc_dec_tiledecode-jpc_dec-c/

Comment 1 Adam Mariš 2017-03-21 14:44:15 UTC

Created jasper tracking bugs for this issue:

Affects: epel-5 [bug 1434466]


Created mingw-jasper tracking bugs for this issue:

Affects: fedora-all [bug 1434467]

Comment 2 Tomas Hoger 2017-03-24 13:58:31 UTC

This issue was previously reported in bug 1388840.

Comment 3 Tomas Hoger 2017-03-24 14:00:35 UTC


*** This bug has been marked as a duplicate of bug 1388840 ***

Comment 4 Andrej Nemec 2017-07-19 15:22:19 UTC

Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1434464]


Created mingw-jasper tracking bugs for this issue:

Affects: epel-7 [bug 1434465]