Bug 1593554 – CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via crafted BMP image

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1593554 - (CVE-2018-1152) CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via crafted BMP image

Summary:	CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via ...

Status:	NEW

Aliases:	CVE-2018-1152

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20180613,reported=2...
Keywords:	Security

Depends On:	1593556 1593558 1593555 1593557
Blocks:	1593560
	Show dependency tree / graph

Reported:	2018-06-21 01:13 EDT by Sam Fowler
Modified:	2018-07-05 15:13 EDT (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Sam Fowler 2018-06-21 01:13:28 EDT

libjpeg-turbo through version 1.5.90 is vulnerable to a divide by zero flaw in the rdbmp.c:start_input_bmp() function. An attacker could exploit this to cause a denial of service via crafted BMP image.


External Reference:

https://www.tenable.com/security/research/tra-2018-17


Upstream patch:

https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6

Comment 1 Sam Fowler 2018-06-21 01:14:17 EDT

Created libjpeg-turbo tracking bugs for this issue:

Affects: fedora-all [bug 1593555]


Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-all [bug 1593556]

Comment 3 Sam Fowler 2018-06-21 01:15:34 EDT

Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-7 [bug 1593558]

Comment 5 Stefan Cornelius 2018-07-05 15:13:30 EDT

The floating point exception actually happens in the "alloc_sarray()" function, although the patch adds checks to "start_input_bmp()" function. The cjpeg binaries we ship in RHEL7 refuse to load the specially crafted BMP file. It seems like the only obvious vector is via the "tjLoadImage()" function, which was added to 2.x versions and is not yet available in versions we ship in RHEL6/7.

Comment 6 Stefan Cornelius 2018-07-05 15:13:41 EDT

Statement:

This issue did not affect the versions of libjpeg-turbo as shipped with Red Hat Enterprise Linux 6 and 7.

Note You need to log in before you can comment on or make changes to this bug.