Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 560632 (CVE-2015-8871) - <media-libs/openjpeg-2.1.1_p20160922: Use-after-free vulnerability in opj_j2k_write_mco
Summary: <media-libs/openjpeg-2.1.1_p20160922: Use-after-free vulnerability in opj_j2k...
Status: RESOLVED FIXED
Alias: CVE-2015-8871
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [glsa cve]
Keywords:
: 593826 (view as bug list)
Depends on: CVE-2016-7445
Blocks:
  Show dependency tree
 
Reported: 2015-09-16 12:35 UTC by Agostino Sarubbo
Modified: 2016-12-08 13:56 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-09-16 12:35:45 UTC 
From ${URL} :

Use-after-free vulnerability was found in j2k.c in opj_j2k_write_mco function.

'l_current_data' is set to 'p_j2k->m_specific_param.m_encoder.m_header_tile_data',
'p_j2k->m_specific_param.m_encoder.m_header_tile_data' is later used as arg of 'realloc' and can be freed depending on the length of 'l_mco_size',
'l_current_data' is later used and can point to a freed memory zone

Upstream patch:

https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Arfrever Frehtes Taifersar Arahesis 2016-08-13 01:50:20 UTC 
https://github.com/uclouvain/openjpeg/blob/v2.1.1/CHANGELOG.md
" ・ Use-after-free in opj_j2k_write_mco #563"

media-libs/openjpeg-2.1.1 with above fix was released on 2016-07-05.
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2016-09-16 03:03:00 UTC 
(In reply to Arfrever Frehtes Taifersar Arahesis from comment #1)
> media-libs/openjpeg-2.1.1 with above fix was released on 2016-07-05.

Maintainers need to put in summary during the call for stabilization.
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2016-09-16 03:09:00 UTC 
*** Bug 593826 has been marked as a duplicate of this bug. ***
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2016-09-26 14:09:35 UTC 
With the permission of the Gentoo Graphics project I pushed =media-libs/openjpeg-2.1.1_p20160922 into the tree: Actually we wanted to wait for an official v2.1.2 release but upstream postponed the release for another week. Because Gentoo is still at v2.1.0 which has some critical vulnerabilities which are allowing drive-by-download attacks we decided to do a snapshot release.

This snaptshot release (based on v2.1.1) from 2016-09-22 does contain all currently published security fixes, up to CVE-2016-7445:

> commit 30e68615830631059a72b52682ab81bb8b3ca153
> Author: Thomas Deutschmann
> Date:   Mon Sep 26 15:56:16 2016 +0200
> 
>     media-libs/openjpeg: Bump to snapshot release based on v2.1.1 from 2016-09-22
> 
>     Ebuild-releated changes:
>     ========================
>      - EAPI bumped to v6
> 
>      - Test suite re-enabled and fixed (bug #409263)
> 
>     Gentoo-Bug: https://bugs.gentoo.org/409263
>     Gentoo-Bug: https://bugs.gentoo.org/577608
>     Gentoo-Bug: https://bugs.gentoo.org/572430
>     Gentoo-Bug: https://bugs.gentoo.org/560632
>     Gentoo-Bug: https://bugs.gentoo.org/594740
> 
>     Package-Manager: portage-2.3.1
Comment 5 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-07 23:59:14 UTC 
Added to existing GLSA.
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2016-12-08 13:56:55 UTC 
This issue was resolved and addressed in
 GLSA 201612-26 at https://security.gentoo.org/glsa/201612-26
by GLSA coordinator Aaron Bauman (b-man).