Bug 473462 (CVE-2008-5316)

Summary: CVE-2008-5316 lcms: insufficient input validation in ReadEmbeddedTextTag
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: andreas.bierfert, kreilly, tbzatek
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-03-29 08:39:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 473469, 473470, 479384, 833921    
Bug Blocks:    
Attachments:
Description Flags
Patch used in SuSE security updates none

Description Tomas Hoger 2008-11-28 16:24:18 UTC 
The ReadEmbeddedTextTag in src/cmsio1.c did not properly check amount
of data read from the input file to the buffer provided as one of its
arguments.  Value read from the file was used as an upper bound without
any validation.

This issue was fixed upstream in 1.16.

Upstream CVS commit:
http://lcms.cvs.sourceforge.net/viewvc/lcms/lcms/src/cmsio1.c?r1=1.33&r2=1.34
(some of the previous changes may be needed for 1.15)

References:
http://www.openwall.com/lists/oss-security/2008/11/28/3
Comment 1 Tomas Hoger 2008-11-28 16:26:03 UTC 
Created attachment 325024 [details]
Patch used in SuSE security updates

This was extracted from SuSE liblcms-1.15-32.src.rpm.  Original name of the patch was lcms-CVE-2007-2741.patch, but CVE-2007-2741 is a different issue that got fixed upstream in 1.15.
Comment 2 Tomas Hoger 2008-11-28 16:27:06 UTC 
Affected lcms versions are currently in Red Hat Enterprise Linux 5 and EPEL 4 (both based on upstream 1.15).
Comment 4 Tomas Hoger 2008-12-03 17:16:27 UTC 
CVE id CVE-2008-5316 was assigned to this issue:

Buffer overflow in the ReadEmbeddedTextTag function in src/cmsio1.c in
Little cms color engine (aka lcms) before 1.16 allows attackers to
have an unknown impact via vectors related to a length parameter
inconsistency involving the contents of "the input file," a different
vulnerability than CVE-2007-2741.
Comment 6 Tomas Hoger 2010-03-29 08:39:11 UTC 
https://www.redhat.com/security/data/cve/CVE-2008-5316.html