Bug 1299767 - (CVE-2016-1923) CVE-2016-1923 openjpeg: out of bounds read in opj_j2k_update_image_data
CVE-2016-1923 openjpeg: out of bounds read in opj_j2k_update_image_data
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20160118,repor...
: Reopened, Security
Depends On: 1299768 1299769 1299770 1299771 1377769 1377770 1377771 1377772
Blocks: 1299764
  Show dependency treegraph
 
Reported: 2016-01-19 04:26 EST by Andrej Nemec
Modified: 2016-11-08 11:26 EST (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-09-20 20:28:22 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Andrej Nemec 2016-01-19 04:26:31 EST
A vulnerability was found in a way OpenJpeg parses certain JPEG 2000 image files. The function opj_j2k_update_image_data is vulnerable to heap buffer overflow. A specially crafted file can crash the application.

Original source with reproducer attached:

http://seclists.org/oss-sec/2016/q1/128
Comment 1 Andrej Nemec 2016-01-19 04:27:41 EST
Created openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1299768]
Affects: epel-6 [bug 1299770]
Affects: epel-7 [bug 1299771]
Comment 2 Andrej Nemec 2016-01-19 04:27:49 EST
Created mingw-openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1299769]
Comment 3 Sandro Mani 2016-09-18 04:23:12 EDT
The functions affected by the vulnerability do not exist in openjpeg 1.x, so this is actually NOTABUG. What is the correct way to close this bug and dependent bugs?
Comment 4 Rex Dieter 2016-09-18 07:53:20 EDT
marking it (and dependents) as CLOSED->NOTABUG (with explanation, of course) should suffice
Comment 5 Sandro Mani 2016-09-18 08:01:59 EDT
Closing since this vulnerability does not affect openjpeg 1.x (the affected functions to not exist in openjpeg 1.x).
Comment 6 Adam Mariš 2016-09-19 04:43:56 EDT
> What is the correct way to close this bug and dependent bugs?

> marking it (and dependents) as CLOSED->NOTABUG (with explanation, of course)
> should suffice

Thank you for checking it! But it would be better if you just close the bugs filed against Fedora/EPEL (as a maintainer) and leave closing this (flaw)bug for Product Security.

Thanks!
Comment 7 Martin Prpič 2016-09-20 10:56:59 EDT
Created mingw-openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1377770]
Comment 8 Martin Prpič 2016-09-20 10:57:07 EDT
Created openjpeg2 tracking bugs for this issue:

Affects: epel-all [bug 1377771]
Comment 9 Martin Prpič 2016-09-20 10:59:26 EDT
(In reply to Sandro Mani from comment #5)
> Closing since this vulnerability does not affect openjpeg 1.x (the affected
> functions to not exist in openjpeg 1.x).

While that's true for openjpeg, we were missing openjpeg2 and mingw-openjpeg2 from the list of affected packages. Re-opening this flaw; tracking bugs for Fedora/EPEL have been filed.
Comment 10 Doran Moppert 2016-09-20 20:26:42 EDT
I am unable to reproduce the crash on current Fedora openjpeg, however discussion in the upstream patch talks about fixing integer overflow issues associated with use of opj_int_ceildiv.

See also bug 1299772 (same upstream ticket) and bug 1374329 comment #14 which may be related.

Note You need to log in before you can comment on or make changes to this bug.