CVE-2015-5221: Use After Free
A use-after-free which leads to double-free vulnerability was found in Jasper JPEG-2000 library, in src/libjasper/mif/mifcod.c file.
553 case MIFHSAMP: 554 cmpt->sampperx = atoi(jastvparsergetval(tvp)); 555 break; 556 case MIFVSAMP: 557 cmpt->samppery = atoi(jastvparsergetval(tvp)); 558 break;
572 jastvparserdestroy(tvp); 573 if (!cmpt->sampperx || !cmpt->samppery) { 574 goto error; 575 } 576 if (mifhdraddcmpt(hdr, hdr->numcmpts, cmpt)) { 577 goto error; 578 } 579 return 0; 580 581 error: 582 if (cmpt) { 583 mifcmptdestroy(cmpt); 584 } 585 if (tvp) { 586 jastvparserdestroy(tvp); 587 } 588 return -1;
Both tvp and tvp->buf are freed by jastvparserdestroy(tvp), but if one of the two following branch conditions is taken, a second call to jastvparserdestroy(tvp) occurs. It is a use-after-free because before calling free in jastvparserdestroy there is a check to tvp->buf, while tvp could have been freed. Two double free take place just after this check (on tvp->buf and tvp).
Public via:
http://seclists.org/oss-sec/2015/q3/408
Acknowledgements:
Name: Josselin Feist
Other sources
Use-after-free vulnerability in the mifprocesscmpt function in libjasper/mif/mifcod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5221?
CVE-2015-5221 has a moderate severity rating due to the potential for a use-after-free condition leading to a double-free vulnerability.
How do I fix CVE-2015-5221?
To fix CVE-2015-5221, update the Jasper library to version 1.900.2 or later.
What software is affected by CVE-2015-5221?
CVE-2015-5221 affects the Jasper JPEG-2000 library found in multiple distributions including Debian, Fedora, and openSUSE.
What vulnerability type is CVE-2015-5221?
CVE-2015-5221 is classified as a use-after-free vulnerability.
Can CVE-2015-5221 lead to code execution?
Yes, CVE-2015-5221 could potentially allow attackers to execute arbitrary code due to memory corruption.