Bug 1664872 (CVE-2018-20622)
| Summary: | CVE-2018-20622 jasper: memory leak in jpc_dec_decodepkt() | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Laura Pardo <lpardo> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | rh-spice-bugs |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jasper 2.0.17 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in Jasper due to a memory leak in base/jas_malloc.c in libjasper.a when the --output-format jp2 option is used, an attacker could exploit this flaw by persuading a victim to open a specially crafted file, leading to a memory leak that could result in the exposure of sensitive information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-05-06 08:37:34 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1664873, 1664874, 1664875 | ||
| Bug Blocks: | 1664868 | ||
|
Description
Laura Pardo
2019-01-09 21:32:43 UTC
Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1664873] Created mingw-jasper tracking bugs for this issue: Affects: epel-7 [bug 1664875] Affects: fedora-all [bug 1664874] The main problem demonstrated by the reproducer in the upstream bug report is a duplicate of CVE-2017-13748 (see bug 1488961). Besides the tile data memory leak, the reproducer also triggers a minor memory leak in jpc_dec_decodepkt(), which calls jpc_bitstream_sopen(), which does memory allocation, but does not do matching jpc_bitstream_close() call to release the memory when error is encountered. The following comment in the upstream bug provides more details: https://github.com/mdadams/jasper/issues/193#issuecomment-624510298 Note that the CVE description is wrong - there's no problem in jas_malloc.c, and the problem is not limited to situations when converting to jp2 format, as it happens in the (jpc) decoder rather than jp2 encoder. Upstream commit: https://github.com/jasper-software/jasper/commit/aa8516b28344aa1263ee538bb7366c4679a0e1a5 The issue was fixed upstream in jasper 2.0.17. |