Heap-based buffer overflow was found in jpc_dec_cp_setfromcox() triggered by malformed jpeg2000 file.
Created mingw-jasper tracking bugs for this issue:
Affects: fedora-all [bug 1388874]
Affects: epel-7 [bug 1388876]
Created jasper tracking bugs for this issue:
Affects: fedora-all [bug 1388873]
Affects: epel-5 [bug 1388875]
This really is a duplicate of CVE-2011-4516 (bug 747726), with slightly different symptoms. The problem is missing check of the maximum value for the number of resolution levels (numrlvls) in the jpc_cox_getcompparms() function.
This could lead to out-of-bounds write directly in the jpc_cox_getcompparms() function as originally described for CVE-2011-4516 - when writing to rlvls array inside jpc_coxcp_t type structure compparms.
In case of the CVE-2016-8880 reproducer, out-of-bounds write in jpc_cox_getcompparms() was avoided, and a different out-of-bounds reads and writes were triggered in jpc_dec_cp_setfromcox() - reading from the mentioned rlvls array and writing to prcwidthexpns and prcheightexpns arrays inside of the ccp structure of type jpc_dec_ccp_t.
In Red Hat products, this issue was already corrected in previous updates for CVE-2011-4516.
Problem was addressed upstream in version 1.900.5 via this commit:
This CVE was rejected by Mitre:
Common Vulnerabilities and Exposures assigned an identifier CVE-2016-8880 to
the following vulnerability:
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs:
CVE-2011-4516. Reason: This candidate is a duplicate of CVE-2011-4516.
Notes: All CVE users should reference CVE-2011-4516 instead of this
candidate. All references and descriptions in this candidate have been
removed to prevent accidental usage.
*** This bug has been marked as a duplicate of bug 747726 ***
This flaw was found to be a duplicate of CVE-2011-4516. Please see https://access.redhat.com/security/cve/CVE-2011-4516 for information about affected products and security errata.