Bug 1314472 - (CVE-2016-2116) CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
CVE-2016-2116 jasper: memory leak in jas_iccprof_createfrombuf()
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20160303,reported=2...
: Security
Depends On: 1439172 1314473 1314474 1314475 1314476 1439171 1439173 1439174
Blocks: 1314477
  Show dependency treegraph
 
Reported: 2016-03-03 12:02 EST by Adam Mariš
Modified: 2017-05-09 17:40 EDT (History)
28 users (show)

See Also:
Fixed In Version: jasper 1.900.2
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-05-09 17:40:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2016-03-03 12:02:15 EST
Memory leak in jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier was found, allowing remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file.

Vulnerable code:

src/libjasper/base/jas_icc.c:
1685    jas_iccprof_t *jas_iccprof_createfrombuf(uchar *buf, int len)
1686    {
1687            jas_stream_t *in;
1688            jas_iccprof_t *prof;
1689            if (!(in = jas_stream_memopen(JAS_CAST(char *, buf), len)))
1690                    goto error;
1691            if (!(prof = jas_iccprof_load(in)))
1692                    goto error;
1693            jas_stream_close(in);
1694            return prof;
1695    error:
1696            return 0;
1697    }

jas_stream_t allocated by the call to jas_stream_memopen() is leaked if jas_iccprof_load() fails on line 1691.

Proposed patch:

http://seclists.org/oss-sec/2016/q1/att-507/CVE-2016-2116.patch

Public via (contains crash report):

http://seclists.org/oss-sec/2016/q1/507
Comment 1 Adam Mariš 2016-03-03 12:03:32 EST
Created mingw-jasper tracking bugs for this issue:

Affects: fedora-all [bug 1314474]
Affects: epel-7 [bug 1314476]
Comment 2 Adam Mariš 2016-03-03 12:03:49 EST
Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1314473]
Affects: epel-5 [bug 1314475]
Comment 3 Fedora Update System 2016-08-15 17:20:47 EDT
jasper-1.900.1-33.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2016-09-09 17:50:55 EDT
jasper-1.900.1-33.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Tomas Hoger 2016-11-23 16:35:36 EST
Fix was integrated upstream in version 1.900.2:

https://github.com/mdadams/jasper/commit/142245b9bbb33274a7c620aa7a8f85bc00b2d68e
Comment 8 errata-xmlrpc 2017-05-09 13:16:42 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1208 https://access.redhat.com/errata/RHSA-2017:1208

Note You need to log in before you can comment on or make changes to this bug.