Bug 1146571 (CVE-2019-15144)

Summary: VUL-0: CVE-2019-15144: djvulibre: In DjVuLibre 3.5.27, the sorting functionality allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file
Product: [Novell Products] SUSE Security Incidents Reporter: Wolfgang Frisch <wolfgang.frisch>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/240409/
Whiteboard: CVSSv2:NVD:CVE-2019-15144:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2019-15144:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSSv3:SUSE:CVE-2019-15144:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: djvulibre-CVE-2019-15144.patch

Description Wolfgang Frisch 2019-08-21 09:18:18 UTC
CVE-2019-15144

In DjVuLibre 3.5.27, the sorting functionality allows attackers to cause a denial-of-service (application crash due to an
Uncontrolled Recursion) by crafting a PBM image file that is mishandled in
libdjvu/GContainer.h.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15144
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15144.html
http://www.cvedetails.com/cve/CVE-2019-15144/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15144
https://sourceforge.net/p/djvu/djvulibre-git/ci/e15d51510048927f172f1bf1f27ede65907d940d/
https://sourceforge.net/p/djvu/bugs/299/
Comment 1 Wolfgang Frisch 2019-08-21 09:31:56 UTC
Following an investigation of the source code, I conclude that all supported versions of djvulibre are affected:

SUSE:SLE-11:Update
SUSE:SLE-12:Update
SUSE:SLE-15:Update

The patch supplied by upstream applies cleanly to all our versions of djvulibre.
https://sourceforge.net/p/djvu/djvulibre-git/ci/e15d51510048927f172f1bf1f27ede65907d940d/
Comment 2 Wolfgang Frisch 2019-08-21 09:34:49 UTC
Created attachment 814922 [details]
djvulibre-CVE-2019-15144.patch
Comment 3 Petr Gajdos 2019-09-02 11:05:58 UTC
BEFORE

devel,15/djvulibre

$ cjb2 so_GContainer.h_557_2.pbm /dev/null
AddressSanitizer:DEADLYSIGNAL
=================================================================
==20108==ERROR: AddressSanitizer: stack-overflow on address 0x7fffe0c5dfb0 (pc 0x55cefd7c29f4 bp 0x7fffe145c458 sp 0x7fffe0c5dfa0 T0)
    #0 0x55cefd7c29f3  (/usr/bin/cjb2+0x119f3)
    #1 0x55cefd7c2f37  (/usr/bin/cjb2+0x11f37)
[..]
    #246 0x55cefd7c2f46  (/usr/bin/cjb2+0x11f46)
    #247 0x55cefd7c2f46  (/usr/bin/cjb2+0x11f46)
    #248 0x55cefd7c2f46  (/usr/bin/cjb2+0x11f46)

SUMMARY: AddressSanitizer: stack-overflow (/usr/bin/cjb2+0x119f3) 
==20108==ABORTING
$

12/djvulibre: no stack-overflow asan error detected
11/djvulibre: no valgrind error detected

PATCH

referenced in comment 0; as stated in comment 1, applicable everywhere

AFTER

devel,15/djvulibre

$ cjb2 so_GContainer.h_557_2.pbm /dev/null
$
[no ASAN report]
Comment 5 Petr Gajdos 2019-09-02 11:08:19 UTC
Will submit for devel,15,12,11/djvulibre.
Comment 6 Petr Gajdos 2019-09-02 12:18:28 UTC
I believe all fixed.
Comment 7 Swamp Workflow Management 2019-09-02 12:50:09 UTC
This is an autogenerated message for OBS integration:
This bug (1146571) was mentioned in
https://build.opensuse.org/request/show/727759 Factory / djvulibre
Comment 9 Swamp Workflow Management 2019-09-24 13:21:31 UTC
SUSE-SU-2019:2444-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1146569,1146571,1146572,1146702
CVE References: CVE-2019-15142,CVE-2019-15143,CVE-2019-15144,CVE-2019-15145
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    djvulibre-3.5.25.3-5.3.1
SUSE Linux Enterprise Server 12-SP4 (src):    djvulibre-3.5.25.3-5.3.1
SUSE Linux Enterprise Desktop 12-SP4 (src):    djvulibre-3.5.25.3-5.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2019-09-24 19:11:33 UTC
SUSE-SU-2019:2452-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1146569,1146571,1146572,1146702
CVE References: CVE-2019-15142,CVE-2019-15143,CVE-2019-15144,CVE-2019-15145
Sources used:
SUSE Linux Enterprise Module for Packagehub Subpackages 15 (src):    djvulibre-3.5.27-3.3.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    djvulibre-3.5.27-3.3.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src):    djvulibre-3.5.27-3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    djvulibre-3.5.27-3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    djvulibre-3.5.27-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2019-09-30 10:11:33 UTC
openSUSE-SU-2019:2217-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1146569,1146571,1146572,1146702
CVE References: CVE-2019-15142,CVE-2019-15143,CVE-2019-15144,CVE-2019-15145
Sources used:
openSUSE Leap 15.0 (src):    djvulibre-3.5.27-lp150.2.3.1
Comment 12 Swamp Workflow Management 2019-09-30 19:13:18 UTC
openSUSE-SU-2019:2219-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 1146569,1146571,1146572,1146702
CVE References: CVE-2019-15142,CVE-2019-15143,CVE-2019-15144,CVE-2019-15145
Sources used:
openSUSE Leap 15.1 (src):    djvulibre-3.5.27-lp151.3.3.1
Comment 13 Marcus Meissner 2019-10-20 08:15:29 UTC
done