Bug 1314472 (CVE-2016-2116) - CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
Summary: CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
Status: CLOSED ERRATA
Alias: CVE-2016-2116
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20160303,reported=2...
Keywords: Security
Depends On: 1314473 1314474 1314475 1314476 1439171 1439172 1439173 1439174
Blocks: 1314477
TreeView+ depends on / blocked
 
Reported: 2016-03-03 17:02 UTC by Adam Mariš
Modified: 2017-05-09 21:40 UTC (History)
28 users (show)

Fixed In Version: jasper 1.900.2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-05-09 21:40:56 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1208 normal SHIPPED_LIVE Important: jasper security update 2017-05-09 21:13:57 UTC

Description Adam Mariš 2016-03-03 17:02:15 UTC
Memory leak in jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier was found, allowing remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file.

Vulnerable code:

src/libjasper/base/jas_icc.c:
1685    jas_iccprof_t *jas_iccprof_createfrombuf(uchar *buf, int len)
1686    {
1687            jas_stream_t *in;
1688            jas_iccprof_t *prof;
1689            if (!(in = jas_stream_memopen(JAS_CAST(char *, buf), len)))
1690                    goto error;
1691            if (!(prof = jas_iccprof_load(in)))
1692                    goto error;
1693            jas_stream_close(in);
1694            return prof;
1695    error:
1696            return 0;
1697    }

jas_stream_t allocated by the call to jas_stream_memopen() is leaked if jas_iccprof_load() fails on line 1691.

Proposed patch:

http://seclists.org/oss-sec/2016/q1/att-507/CVE-2016-2116.patch

Public via (contains crash report):

http://seclists.org/oss-sec/2016/q1/507

Comment 1 Adam Mariš 2016-03-03 17:03:32 UTC
Created mingw-jasper tracking bugs for this issue:

Affects: fedora-all [bug 1314474]
Affects: epel-7 [bug 1314476]

Comment 2 Adam Mariš 2016-03-03 17:03:49 UTC
Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1314473]
Affects: epel-5 [bug 1314475]

Comment 3 Fedora Update System 2016-08-15 21:20:47 UTC
jasper-1.900.1-33.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2016-09-09 21:50:55 UTC
jasper-1.900.1-33.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 5 Tomas Hoger 2016-11-23 21:35:36 UTC
Fix was integrated upstream in version 1.900.2:

https://github.com/mdadams/jasper/commit/142245b9bbb33274a7c620aa7a8f85bc00b2d68e

Comment 8 errata-xmlrpc 2017-05-09 17:16:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1208 https://access.redhat.com/errata/RHSA-2017:1208


Note You need to log in before you can comment on or make changes to this bug.