Bug 1311126 (CVE-2016-1951) - CVE-2016-1951 nspr: Memory allocation issue related to PR_*printf functions
Summary: CVE-2016-1951 nspr: Memory allocation issue related to PR_*printf functions
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2016-1951
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1311127
TreeView+ depends on / blocked
 
Reported: 2016-02-23 12:56 UTC by Adam Mariš
Modified: 2021-02-17 04:18 UTC (History)
3 users (show)

Fixed In Version: nspr 4.12
Clone Of:
Environment:
Last Closed: 2019-06-08 02:48:46 UTC
Embargoed:


Attachments (Terms of Use)

Description Adam Mariš 2016-02-23 12:56:55 UTC
It was reported that unspecified memory allocation bug related to PR_*printf functions was fixed in nspr 4.12.

External Reference:

https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/dV4MyMsg6jw

Comment 1 Huzaifa S. Sidhpurwala 2016-03-14 05:17:55 UTC
Upstream bug report:

https://bugzilla.mozilla.org/show_bug.cgi?id=1174015

Upstream commit:

https://hg.mozilla.org/projects/nspr/rev/96381e3aaae2

Comment 2 Huzaifa S. Sidhpurwala 2016-06-10 05:23:11 UTC
This issue was fixed in nspr-4.12

Fedora 22 and Fedora 23 currently ship nspr-4.12 and therefore is not affected by this flaw.

Comment 4 Martin Prpič 2016-08-29 11:56:23 UTC
This issue will be fixed in the next nspr rebase in minor versions of RHEL 6 and 7.

Comment 5 Huzaifa S. Sidhpurwala 2016-10-21 08:50:05 UTC
Analysis:

There is an integer overflow followed by a heap-buffer overflow in the functions PR_vsmprintf() and PR_vsprintf_append(). Both of these functions internally use GrowStuff() which uses 32-bit integers to calculate string sizes which results in overflow at different places depending on 32-bit or 64-bit architecture. 

Applications compiled against NSS library, in which very large untrusted  strings are passed to the above functions are vulnerable to this flaw.


Note You need to log in before you can comment on or make changes to this bug.