Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 594740 (CVE-2016-7445) - <media-libs/openjpeg-2.1.1_p20160922: Openjpeg null ptr dereference
Summary: <media-libs/openjpeg-2.1.1_p20160922: Openjpeg null ptr dereference
Alias: CVE-2016-7445
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B3 [glsa cve]
Depends on:
Blocks: CVE-2015-8871 CVE-2016-1923, CVE-2016-1924 CVE-2016-3181, CVE-2016-3182, CVE-2016-3183
  Show dependency tree
Reported: 2016-09-22 01:29 UTC by Ian Zimmerman
Modified: 2016-12-08 13:57 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Ian Zimmerman 2016-09-22 01:29:28 UTC
According to the announce on oss-security:

In convert.c:1483 and convert.c:1485, variable s is uncheck after
skip_int is called.
A null ptr will be passed to skip_int again and will cause a null ptr

# External link

(follow the link above to a patch)

Reproducible: Always
Comment 1 Agostino Sarubbo gentoo-dev 2016-09-22 06:49:38 UTC
there are some open issues for openjpeg that will be fixed in 2.0.2, so I guess we will bump it when available.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2016-09-23 04:07:30 UTC
CVE-2016-7445 (
  ** RESERVED ** This candidate has been reserved by an organization or
  individual that will use it when announcing a new security problem. When the
  candidate has been publicized, the details for this candidate will be
  //** TEMPORARY **//
  OpenJpeg - variable s is uncheck after skip_int is called. A null ptr will
  be passed to skip_int again and will cause a null ptr dereference.
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2016-09-26 14:09:27 UTC
With the permission of the Gentoo Graphics project I pushed =media-libs/openjpeg-2.1.1_p20160922 into the tree: Actually we wanted to wait for an official v2.1.2 release but upstream postponed the release for another week. Because Gentoo is still at v2.1.0 which has some critical vulnerabilities which are allowing drive-by-download attacks we decided to do a snapshot release.

This snaptshot release (based on v2.1.1) from 2016-09-22 does contain all currently published security fixes, up to CVE-2016-7445:

> commit 30e68615830631059a72b52682ab81bb8b3ca153
> Author: Thomas Deutschmann
> Date:   Mon Sep 26 15:56:16 2016 +0200
>     media-libs/openjpeg: Bump to snapshot release based on v2.1.1 from 2016-09-22
>     Ebuild-releated changes:
>     ========================
>      - EAPI bumped to v6
>      - Test suite re-enabled and fixed (bug #409263)
>     Gentoo-Bug:
>     Gentoo-Bug:
>     Gentoo-Bug:
>     Gentoo-Bug:
>     Gentoo-Bug:
>     Package-Manager: portage-2.3.1
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2016-09-26 14:30:20 UTC
@ Arches,

please test and mark stable: =media-libs/openjpeg-2.1.1_p20160922

Stable targets: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Comment 5 Agostino Sarubbo gentoo-dev 2016-09-26 18:57:15 UTC
amd64 stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-09-26 18:58:37 UTC
x86 stable
Comment 7 Jeroen Roovers (RETIRED) gentoo-dev 2016-09-27 04:21:56 UTC
Stable for HPPA PPC64.
Comment 8 Tobias Klausmann (RETIRED) gentoo-dev 2016-09-27 08:17:26 UTC
Stable on alpha.
Comment 9 Agostino Sarubbo gentoo-dev 2016-09-29 09:42:20 UTC
sparc stable
Comment 10 Agostino Sarubbo gentoo-dev 2016-09-29 12:40:00 UTC
ppc stable
Comment 11 Agostino Sarubbo gentoo-dev 2016-09-29 13:15:50 UTC
arm stable
Comment 12 Agostino Sarubbo gentoo-dev 2016-09-29 13:32:25 UTC
ia64 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 13 Aaron Bauman (RETIRED) gentoo-dev 2016-11-11 12:59:40 UTC
@maintainer(s), please cleanup the vulnerable versions so we can close this.

GLSA Vote: No
Comment 14 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-07 23:16:06 UTC
I forgot that maintainers (maekke) gave me permission to cleanup. Now cleaned up:
Comment 15 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-07 23:58:26 UTC
Added to existing GLSA.
Comment 16 GLSAMaker/CVETool Bot gentoo-dev 2016-12-08 13:57:18 UTC
This issue was resolved and addressed in
 GLSA 201612-26 at
by GLSA coordinator Aaron Bauman (b-man).