Bug 1491853 – CVE-2017-14229 jasper: excessive looping in jpc_dec_tileinit()

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1491853 - (CVE-2017-14229) CVE-2017-14229 jasper: excessive looping in jpc_dec_tileinit()

Summary:	CVE-2017-14229 jasper: excessive looping in jpc_dec_tileinit()

Status:	NEW

Aliases:	CVE-2017-14229

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20170911,repor...
Keywords:	Security

Depends On:	1491855 1491856 1491854
Blocks:	1449402
	Show dependency tree / graph

Reported:	2017-09-14 16:37 EDT by Pedro Sampaio
Modified:	2018-07-18 11:31 EDT (History)
CC List:	18 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Pedro Sampaio 2017-09-14 16:37:47 EDT

There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of
Jasper 2.0.13. It will lead to a remote denial of service attack.

Upstream bug:

https://github.com/mdadams/jasper/issues/146

References:

https://bugzilla.novell.com/show_bug.cgi?id=1058000

Comment 1 Pedro Sampaio 2017-09-14 16:38:36 EDT

Created jasper tracking bugs for this issue:

Affects: fedora-all [bug 1491856]


Created mingw-jasper tracking bugs for this issue:

Affects: epel-7 [bug 1491855]
Affects: fedora-all [bug 1491854]

Comment 2 Tomas Hoger 2017-12-05 08:10:07 EST

The reproducer provided by the issue reporter does not actually demonstrate an infinite loop.  It does trigger an excessive looping, but processing of the reproducer ends after some time.  It is unclear if infinite looping is possible or not.

This issue remains unfixed in the current upstream version 2.0.14.

Note You need to log in before you can comment on or make changes to this bug.