Bug 942553 (CVE-2015-5221) - VUL-0: CVE-2015-5221: jasper: Use-after-free (and double-free) in Jasper JPEG-200 (CVE-2015-5221)
Summary: VUL-0: CVE-2015-5221: jasper: Use-after-free (and double-free) in Jasper JPEG...
Status: RESOLVED FIXED
Alias: CVE-2015-5221
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2017-08-08
Assignee: Fridrich Strba
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/130474/
Whiteboard: CVSSv2:RedHat:CVE-2015-5221:5.1:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-20 16:39 UTC by Alexander Bergmann
Modified: 2019-11-02 19:49 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2015-08-20 16:39:50 UTC
Via OSS Security: http://seclists.org/oss-sec/2015/q3/408

-----------------------------
A new use-after-free was found in Jasper JPEG-200.

The use-after-free appears in the function mif_process_cmpt of the src/libjasper/mif/mif_cod.c file. Both tvp and tvp->buf are freed by jas_tvparser_destroy(tvp) (line 572), but if one of the two following branch conditions is taken (line 573/576), a second call to jas_tvparser_destroy(tvp) occurs (line 586). It is a use-after-free because before calling free in jas_tvparser_destroy there is a check to tvp->buf, while tvp could have been freed. Two double free take place just after this check (on tvp->buf and tvp). A simple fix  should be to move the first call of jas_tvparser_destroy after the two branch conditions (or set tvp to NULL after it has been freed in mif_process_cmpt).

The vulnerability was found by a static binary analysis using the tool gueb (that will become open-source soon).

Since another double-free in this library was found recently (http://seclists.org/oss-sec/2015/q3/366), maybe a patch 
could fix both of them ?

Best regards,
Feist Josselin
-----------------------------

CVE-2015-5221 was assigned to this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5221
http://seclists.org/oss-sec/2015/q3/408
Comment 1 Alexander Bergmann 2015-08-20 16:42:06 UTC
The mentioned double-free is handled in bug 941919.
Comment 2 Swamp Workflow Management 2015-08-20 22:00:16 UTC
bugbot adjusting priority
Comment 3 Swamp Workflow Management 2016-11-04 12:08:46 UTC
openSUSE-SU-2016:2722-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,392410,941919,942553,968373
CVE References: CVE-2008-3522,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8886
Sources used:
openSUSE 13.2 (src):    jasper-1.900.14-163.24.1
Comment 4 Swamp Workflow Management 2016-11-10 20:09:47 UTC
SUSE-SU-2016:2775-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2014-8158,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server 12-SP1 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    jasper-1.900.14-181.1
Comment 5 Swamp Workflow Management 2016-11-10 20:12:24 UTC
SUSE-SU-2016:2776-1: An update that fixes 19 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    jasper-1.900.14-134.25.1
SUSE Linux Enterprise Server 11-SP4 (src):    jasper-1.900.14-134.25.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    jasper-1.900.14-134.25.1
Comment 6 Swamp Workflow Management 2016-11-17 19:09:58 UTC
openSUSE-SU-2016:2833-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2014-8158,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
openSUSE Leap 42.2 (src):    jasper-1.900.14-167.1
openSUSE Leap 42.1 (src):    jasper-1.900.14-166.1
Comment 8 Swamp Workflow Management 2017-07-25 13:26:59 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2017-08-08.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63789
Comment 9 Marcus Meissner 2019-11-02 19:49:00 UTC
released