A memory leak bug in jasper 3.0.6 in function cmdoptsparse.
https://github.com/jasper-software/jasper/issues/332 https://github.com/jasper-software/jasper/commit/d99636fad60629785efd1ef72da772a8ef68f54c
JasPer 2.0.14 has a memory leak in base/jasmalloc.c in libjasper.a when "--output-format jp2" is used.
A double free flaw was found in the way JasPer's jasperimagestopload() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Original report:
http://seclists.org/oss-sec/2015/q3/366
A use-after-free which leads to double-free vulnerability was found in Jasper JPEG-2000 library, in src/libjasper/mif/mifcod.c file.
553 case MIFHSAMP: 554 cmpt->sampperx = atoi(jastvparsergetval(tvp)); 555 break; 556 case MIFVSAMP: 557 cmpt->samppery = atoi(jastvparsergetval(tvp)); 558 break;
572 jastvparserdestroy(tvp); 573 if (!cmpt->sampperx || !cmpt->samppery) { 574 goto error; 575 } 576 if (mifhdraddcmpt(hdr, hdr->numcmpts, cmpt)) { 577 goto error; 578 } 579 return 0; 580 581 error: 582 if (cmpt) { 583 mifcmptdestroy(cmpt); 584 } 585 if (tvp) { 586 jastvparserdestroy(tvp); 587 } 588 return -1;
Both tvp and tvp->buf are freed by jastvparserdestroy(tvp), but if one of the two following branch conditions is taken, a second call to jastvparserdestroy(tvp) occurs. It is a use-after-free because before calling free in jastvparserdestroy there is a check to tvp->buf, while tvp could have been freed. Two double free take place just after this check (on tvp->buf and tvp).
Public via:
http://seclists.org/oss-sec/2015/q3/408
Acknowledgements:
Name: Josselin Feist
Last updated 24 July 2024
The jpccrggetparms function in libjasper/jpc/jpccs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.
A use-after-free flaw was found in the way JasPer decoded certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Upstream issue (including a reproducer);
https://github.com/mdadams/jasper/issues/105
Improper error handling in RAS encoder/decoder with assertion test were found.
Upstream patch:
https://github.com/mdadams/jasper/commit/411a4068f8c464e883358bf403a3e25158863823
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
Race condition in the jasstreamtmpfile function in libjasper/base/jasstream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
Buffer overflow in the jasstreamprintf function in libjasper/base/jasstream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mifhdrput function and use of vsprintf.
A number of vulnerabilities were found and reported by CERT in JasPer which may allow a remote unauthenticated attacker to execute arbitrary code.
Reference: http://www.kb.cert.org/vuls/id/887409
A heap-based buffer overflow flaw was reported in JasPer's jpcdeccpsetfromcox() and jpcdeccpsetfromrgn() functions. Processing a specially-crafted image with an application that uses JasPer could cause the application to crash or, potentially, execute arbitrary code.
Acknowledgements:
Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Jose Duart of the Google Security Team as the original reporter.
Multiple stack-based buffer overflows in jpcqmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.
oCERT reports an issue in jasper discovered by pyddeh:
"""
jpcdec.c:1204:
dec->numhtiles = JPCCEILDIV(dec->xend - dec->tilexoff, dec->tilewidth); dec->numvtiles = JPCCEILDIV(dec->yend - dec->tileyoff, dec->tileheight); dec->numtiles = dec->numhtiles dec->numvtiles; if (!(dec->tiles = jasmalloc(dec->numtiles sizeof(jpcdectilet)))) { return -1; }
the dec->XXX in JPCCEILDIV are all directly from the codestream, so dec->numtiles can be 0. In that case, the minimum-sized chunk returned by malloc can, depending on the code stream, be used later. I think this can cause the same problems as a use after free. Fix proposal:
if ( dec->numtiles == 0 || !(dec->tiles = jasmalloc(dec->numtiles sizeof(jpcdectilet)))) { return -1; }
"""
Acknowledgement:
Red Hat would like to thank oCERT for reporting this issue. oCERT acknowledges pyddeh as the original reporter.
Heap-based buffer overflow in the jp2decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
Double free vulnerability in the jasiccattrvaldestroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
Integer overflow in the jasmatrixcreate function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, related to integer multiplication for memory allocation.
Last updated 24 July 2024
An integer overflow vulnerability that results into use of uninitialized value in jpcpinextcprl was found.
Upstream patch:
https://github.com/mdadams/jasper/commit/1f0dfe5a42911b6880a1445f13f6d615ddb55387
Reference:
http://seclists.org/oss-sec/2017/q1/609
Integer overflow in the jpcdectiledecode function in jpcdec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.
An out-of-bounds heap read vulnerability was found in jpcpinextpcrl() function of jasper when processing crafted input.
Upstream bug:
https://github.com/mdadams/jasper/issues/103
Upstream patch:
https://github.com/mdadams/jasper/commit/99a50593254d1b53002719bbecfc946c84b23d27
Acknowledgments:
Name: Liu Bingchang (IIE)
An integer overflow vulnerability was found in jasper in jasimage.c triggered by parsing of a maliciously crafted file.
Upstream patch:
https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a
References:
http://seclists.org/oss-sec/2016/q4/470
An integer overflow in jpcdecprocesssiz was found that can be triggered by crafted image file when given as input to imginfo
Upstream patch:
https://github.com/mdadams/jasper/commit/d91198abd00fc435a397fe6bad906a4c1748e9cf
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
An assertion failure was possible to trigger in jasseq2dcreate.
Upstream patch:
https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
An assertion failure was possible to trigger in jpcdequantize.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
An assertion failure was possible to trigger in jpcfloorlog2.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
An assertion failure was possible to trigger in calcstepsizes.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
A number of overflows were found in jasper causing use after free vulnerability triggeerd by creafted image.
Upstream patch:
https://github.com/mdadams/jasper/commit/634ce8e8a5accc0fa05dd2c20d42b4749d4b2735
Reproducer:
https://github.com/asarubbo/poc/blob/master/00028-jasper-uaf-jasrealloc
CVE assignment:
http://seclists.org/oss-sec/2016/q4/385
Last updated 24 July 2024