Bug 1491853 (CVE-2017-14229) - CVE-2017-14229 jasper: excessive looping in jpc_dec_tileinit()
Summary: CVE-2017-14229 jasper: excessive looping in jpc_dec_tileinit()
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-14229
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1491854 1491855 1491856
Blocks: 1449402
TreeView+ depends on / blocked
 
Reported: 2017-09-14 20:37 UTC by Pedro Sampaio
Modified: 2020-12-10 21:38 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-12-10 21:38:43 UTC
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2017-09-14 20:37:47 UTC 
There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of
Jasper 2.0.13. It will lead to a remote denial of service attack.

Upstream bug:

https://github.com/mdadams/jasper/issues/146

References:

https://bugzilla.novell.com/show_bug.cgi?id=1058000
Comment 1 Pedro Sampaio 2017-09-14 20:38:36 UTC 
Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1491856]


Created mingw-jasper tracking bugs for this issue:

Affects: epel-7 [bug 1491855]
Affects: fedora-all [bug 1491854]
Comment 2 Tomas Hoger 2017-12-05 13:10:07 UTC 
The reproducer provided by the issue reporter does not actually demonstrate an infinite loop.  It does trigger an excessive looping, but processing of the reproducer ends after some time.  It is unclear if infinite looping is possible or not.

This issue remains unfixed in the current upstream version 2.0.14.
Comment 4 Tomas Hoger 2020-12-10 21:38:43 UTC 
Upstream also concluded that there's no infinite loop, only a slow processing due to malicious file triggering large number of memory allocations.
Note You need to log in before you can comment on or make changes to this bug.