Bug 1629955 (CVE-2018-16982)

Summary:	CVE-2018-16982 opencc: out-of-bounds keyOffset and valueOffset values in BinaryDict::NewFromFile in BinaryDict.cpp
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	eng-i18n-bugs, pwu
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:38:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1629957
Bug Blocks:	1629958

Description Pedro Sampaio 2018-09-17 17:10:04 UTC

Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.

Upstream issue:

https://github.com/BYVoid/OpenCC/issues/303

Comment 2 Stefan Cornelius 2018-11-12 12:38:07 UTC

In version 0.4.3, the code is quite different. The PoCs can still crash the opencc_dict binary, but it's at a different location and does not seem to pose a security risk.

Comment 3 Stefan Cornelius 2018-11-12 12:38:15 UTC

Statement:

This issue did not affect the versions of opencc as shipped with Red Hat Enterprise Linux 7.