Bug 1593554 (CVE-2018-1152)

Summary: CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via crafted BMP image
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: erik-fedora, klember, negativo17, nforro, phracek, rjones, vonsch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:29:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1593555, 1593556, 1593557, 1593558    
Bug Blocks: 1593560    

Description Sam Fowler 2018-06-21 05:13:28 UTC
libjpeg-turbo through version 1.5.90 is vulnerable to a divide by zero flaw in the rdbmp.c:start_input_bmp() function. An attacker could exploit this to cause a denial of service via crafted BMP image.

External Reference:


Upstream patch:


Comment 1 Sam Fowler 2018-06-21 05:14:17 UTC
Created libjpeg-turbo tracking bugs for this issue:

Affects: fedora-all [bug 1593555]

Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-all [bug 1593556]

Comment 3 Sam Fowler 2018-06-21 05:15:34 UTC
Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-7 [bug 1593558]

Comment 5 Stefan Cornelius 2018-07-05 19:13:30 UTC
The floating point exception actually happens in the "alloc_sarray()" function, although the patch adds checks to "start_input_bmp()" function. The cjpeg binaries we ship in RHEL7 refuse to load the specially crafted BMP file. It seems like the only obvious vector is via the "tjLoadImage()" function, which was added to 2.x versions and is not yet available in versions we ship in RHEL6/7.

Comment 6 Stefan Cornelius 2018-07-05 19:13:41 UTC

This issue did not affect the versions of libjpeg-turbo as shipped with Red Hat Enterprise Linux 6 and 7.