Bug 1593554 (CVE-2018-1152) - CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via crafted BMP image
Summary: CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2018-1152
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1593555 1593556 1593557 1593558
Blocks: 1593560
TreeView+ depends on / blocked
 
Reported: 2018-06-21 05:13 UTC by Sam Fowler
Modified: 2021-02-17 00:06 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-10 10:29:43 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-06-21 05:13:28 UTC 
libjpeg-turbo through version 1.5.90 is vulnerable to a divide by zero flaw in the rdbmp.c:start_input_bmp() function. An attacker could exploit this to cause a denial of service via crafted BMP image.


External Reference:

https://www.tenable.com/security/research/tra-2018-17


Upstream patch:

https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6
Comment 1 Sam Fowler 2018-06-21 05:14:17 UTC 
Created libjpeg-turbo tracking bugs for this issue:

Affects: fedora-all [bug 1593555]


Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-all [bug 1593556]
Comment 3 Sam Fowler 2018-06-21 05:15:34 UTC 
Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-7 [bug 1593558]
Comment 5 Stefan Cornelius 2018-07-05 19:13:30 UTC 
The floating point exception actually happens in the "alloc_sarray()" function, although the patch adds checks to "start_input_bmp()" function. The cjpeg binaries we ship in RHEL7 refuse to load the specially crafted BMP file. It seems like the only obvious vector is via the "tjLoadImage()" function, which was added to 2.x versions and is not yet available in versions we ship in RHEL6/7.
Comment 6 Stefan Cornelius 2018-07-05 19:13:41 UTC 
Statement:

This issue did not affect the versions of libjpeg-turbo as shipped with Red Hat Enterprise Linux 6 and 7.
Note You need to log in before you can comment on or make changes to this bug.