There were missing sanity checks in jpc_siz_getparms. Upstream patch: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 CVE assignment: http://seclists.org/oss-sec/2016/q4/441
Created mingw-jasper tracking bugs for this issue: Affects: fedora-all [bug 1396987] Affects: epel-7 [bug 1396989]
Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1396986] Affects: epel-5 [bug 1396988]
This fix further extends checks added for CVE-2016-9390 (bug 1396965). There are 3 CVEs for various symptoms of issues addressed by this fix. All 3 CVEs are covered by this advisory from the original reporter: https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure/ * CVE-2016-9392 Upstream bug report: https://github.com/mdadams/jasper/issues/57 Relevant information from the original reporter's advisory: Affected version: 1.900.13 Output/failure: imginfo: /tmp/portage/media-libs/jasper-1.900.13/work/jasper-1.900.13/src/libjasper/jpc/jpc_dec.c:1637: void calcstepsizes(uint_fast16_t, int, uint_fast16_t *): Assertion `!((expn + (numrlvls – 1) – (numrlvls – 1 – ((bandno > 0) ? ((bandno + 2) / 3) : (0)))) & (~0x1f))’ failed. Commit fix: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 Fixed version: 1.900.17 Testcase: https://github.com/asarubbo/poc/blob/master/00012-jasper-assert-calcstepsizes CVE: CVE-2016-9392 * CVE-2016-9393 Affected version: 1.900.13 Output/failure: type = 0xff41 (UNKNOWN); len = 20;02 40 40 00 00 00 00 ee ff 00 00 00 00 24 00 00 00 00 imginfo: /tmp/portage/media-libs/jasper-1.900.13/work/jasper-1.900.13/src/libjasper/jpc/jpc_t2cod.c:297: int jpc_pi_nextrpcl(jpc_pi_t *): Assertion `pi->prcno pirlvl->numprcs’ failed. Commit fix: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 Fixed version: 1.900.17 Testcase: https://github.com/asarubbo/poc/blob/master/00013-jasper-assert-jpc_pi_nextrpcl CVE: CVE-2016-9393 * CVE-2016-9394 Affected version: 1.900.15 Output/failure: imginfo: /tmp/portage/media-libs/jasper-1.900.15/work/jasper-1.900.15/src/libjasper/base/jas_seq.c:90: jas_matrix_t *jas_seq2d_create(int, int, int, int): Assertion `xstart <= xend && ystart <= yend' failed. Commit fix: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330 Fixed version: 1.900.17 Testcase: https://github.com/asarubbo/poc/blob/master/00016-jasper-assert-jas_matrix_t CVE: CVE-2016-9394
Similar to the CVE-2016-9390 issue, the impact of this flaw seems to be limited to triggering various assertion failures. Failed assertion causes program to exit unexpectedly, but does not allow code execution. As a precaution against impacts other than the known assertion failures, it may get addressed in future jasper packages in Red Hat Enterprise Linux 6 and 7.
*** Bug 1396972 has been marked as a duplicate of this bug. ***
*** Bug 1396975 has been marked as a duplicate of this bug. ***
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2017:1208 https://access.redhat.com/errata/RHSA-2017:1208