Bug 1299772 – CVE-2016-1924 openjpeg: out of bounds read in opj_tgt_reset

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1299772 - (CVE-2016-1924) CVE-2016-1924 openjpeg: out of bounds read in opj_tgt_reset

Summary:	CVE-2016-1924 openjpeg: out of bounds read in opj_tgt_reset

Status:	CLOSED NOTABUG

Aliases:	CVE-2016-1924

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160118,repor...
Keywords:	Reopened, Security

Depends On:	1299775 1299776 1299777 1299778 1377769 1377770 1377771 1377772
Blocks:	1299764 1299766
	Show dependency tree / graph

Reported:	2016-01-19 04:32 EST by Andrej Nemec
Modified:	2016-09-21 20:24 EDT (History)
CC List:	10 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-09-20 20:28:39 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2016-01-19 04:32:16 EST

A vulnerability was found in a way OpenJpeg parses certain JPEG 2000 image files. While parsing a specially crafted file, function opj_tgt_reset can cause a segmentation fault.

Original source with reproducer attached:

http://seclists.org/oss-sec/2016/q1/128

Comment 1 Andrej Nemec 2016-01-19 04:33:09 EST

Created openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1299775]
Affects: epel-6 [bug 1299777]
Affects: epel-7 [bug 1299778]

Comment 2 Andrej Nemec 2016-01-19 04:33:17 EST

Created mingw-openjpeg tracking bugs for this issue:

Affects: fedora-all [bug 1299776]

Comment 3 Sandro Mani 2016-09-18 04:23:17 EDT

The functions affected by the vulnerability do not exist in openjpeg 1.x, so this is actually NOTABUG. What is the correct way to close this bug and dependent bugs?

Comment 4 Sandro Mani 2016-09-18 08:03:28 EDT

Closing since this vulnerability does not affect openjpeg 1.x (the affected functions to not exist in openjpeg 1.x).

Comment 5 Martin Prpič 2016-09-20 10:57:21 EDT

Created mingw-openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1377770]

Comment 6 Martin Prpič 2016-09-20 10:57:37 EDT

Created mingw-openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1377770]

Comment 7 Martin Prpič 2016-09-20 10:57:46 EDT

Created openjpeg2 tracking bugs for this issue:

Affects: fedora-all [bug 1377772]
Affects: epel-all [bug 1377771]

Comment 8 Martin Prpič 2016-09-20 10:59:55 EDT

(In reply to Sandro Mani from comment #4)
> Closing since this vulnerability does not affect openjpeg 1.x (the affected
> functions to not exist in openjpeg 1.x).

While that's true for openjpeg, we were missing openjpeg2 and mingw-openjpeg2 from the list of affected packages. Re-opening this flaw; tracking bugs for Fedora/EPEL have been filed.

Comment 9 Doran Moppert 2016-09-20 20:26:56 EDT

I am unable to reproduce the crash on current Fedora openjpeg, however discussion in the upstream patch talks about fixing integer overflow issues associated with use of opj_int_ceildiv.

See also bug 1299767 (same upstream ticket) and bug 1374329 comment #14 which may be related.

Note You need to log in before you can comment on or make changes to this bug.