| Summary: | jbig2dec-0.13 Heap Buffer Overflow Vulnerability (READ\WRITE) due to Integer Overflow in function jbig2_image_new | ||
|---|---|---|---|
| Product: | jbig2dec | Reporter: | Bingchang <l.bingchang.bc> |
| Component: | Parsing | Assignee: | Henry Stiles <henry.stiles> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | blareblare2000mar, chris.liddell, dg.icepng, hertzog, mehmetgelisin, shailesh.mistry, vficaj |
| Priority: | P4 | ||
| Version: | unspecified | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| Customer: | Word Size: | --- | |
|
Description
Bingchang
2016-12-28 02:24:34 UTC
Created attachment 13264 [details]
analysis report and poc file
The attachment is now marked private, so that only Artifex staff and the original reporter can view it. Please supply the password for the archive. (In reply to Ken Sharp from comment #2) > The attachment is now marked private, so that only Artifex staff and the > original reporter can view it. Please supply the password for the archive. The password is: 1228jbig2dec Hi Ken, when do you expect to publish a patch? At least if the reproducer file was public, we could try to help you craft a fix. Right now we can only wait and ping you. (In reply to Raphaël Hertzog from comment #4) > Hi Ken, when do you expect to publish a patch? > > At least if the reproducer file was public, we could try to help you craft a > fix. Right now we can only wait and ping you. *I* don't intend to publish a patch at all :-) My involvement was simply to get the file attached here so that the code owner can work on it. I'm afraid this code isn't in my area so I can't answer the question, its up to the owner, in this case Henry. Ok, same question to Henri then. :-) FTR this issue has been assigned CVE number CVE-2016-9601 so expect people to look for a fix: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9601 https://security-tracker.debian.org/tracker/CVE-2016-9601 This bug is not present in the latest version of the code in the git repository, both files run correctly and exit with the appropriate error message. The bug was fixed in commit http://git.ghostscript.com/?p=jbig2dec.git;a=commit;h=e698d5c11d27212aa1098bc5b1673a3378563092 Since the fix is now available, can you make the attachment public so that we can verify that the patch effectively fixes the issue reported? (And so that I can double check my backport of your patch for the fixed version I want to upload in Debian 7 Wheezy). Thank you in advance. (In reply to Raphaël Hertzog from comment #8) > Since the fix is now available, can you make the attachment public so that > we can verify that the patch effectively fixes the issue reported? (And so > that I can double check my backport of your patch for the fixed version I > want to upload in Debian 7 Wheezy). > > Thank you in advance. A link was posted in Comment 7 (In reply to Shailesh Mistry from comment #7) > This bug is not present in the latest version of the code in the git > repository, both files run correctly and exit with the appropriate error > message. > > The bug was fixed in commit > http://git.ghostscript.com/?p=jbig2dec.git;a=commit; > h=e698d5c11d27212aa1098bc5b1673a3378563092 Thanks Shelly. I assume users can either get the patch or wait for our next release in March. (In reply to Henry Stiles from comment #9) > (In reply to Raphaël Hertzog from comment #8) > > Since the fix is now available, can you make the attachment public so that > > we can verify that the patch effectively fixes the issue reported? > > A link was posted in Comment 7 That's a link to the patch. I was looking for the attachment which contained the file(s) used to reproduce the problematic behavior (aka the .zip file that was sent by Bingchang). https://bugs.ghostscript.com/attachment.cgi?id=13264 still says that I'm not authorized to access the attachment. (In reply to Raphaël Hertzog from comment #11) > (In reply to Henry Stiles from comment #9) > > (In reply to Raphaël Hertzog from comment #8) > > > Since the fix is now available, can you make the attachment public so that > > > we can verify that the patch effectively fixes the issue reported? > > > > A link was posted in Comment 7 > > That's a link to the patch. I was looking for the attachment which contained > the file(s) used to reproduce the problematic behavior (aka the .zip file > that was sent by Bingchang). > > https://bugs.ghostscript.com/attachment.cgi?id=13264 still says that I'm not > authorized to access the attachment. Yes, sorry a colleague pointed that out to me right after I made the change. Anyway, no we certainly would not make the attachment public until our release in March, and even then I'd be reluctant to release it. |