Bug 1214672 (CVE-2021-46312)

Summary:	VUL-1: CVE-2021-46312: djvulibre: divide by zero in IW44EncodeCodec.cpp
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Carlos López <carlos.lopez>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P4 - Low	CC:	security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/376018/
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-46312:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Carlos López 2023-08-28 08:35:14 UTC

CVE-2021-46312

An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows
attackers to cause a denial of service via divide by zero.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-46312
https://bugzilla.redhat.com/show_bug.cgi?id=2234736
https://www.cve.org/CVERecord?id=CVE-2021-46312
https://sourceforge.net/p/djvu/bugs/344/

Comment 1 Petr Gajdos 2023-08-28 17:16:54 UTC

TW,15,12/djvulibre

:/ # c44 214672/POC > /dev/null
Floating point exception (core dumped)
:/ #

Comment 2 Carlos López 2023-08-29 07:43:16 UTC

(In reply to Petr Gajdos from comment #1)
> TW,15,12/djvulibre
> 
> :/ # c44 214672/POC > /dev/null
> Floating point exception (core dumped)
> :/ #

We also have djvulibre in SUSE:SLE-15-SP2:Update and SUSE:ALP:Source:Standard:1.0.

Comment 3 Petr Gajdos 2023-08-29 10:38:31 UTC

(In reply to Carlos López from comment #2)
> (In reply to Petr Gajdos from comment #1)
> > TW,15,12/djvulibre
> > 
> > :/ # c44 214672/POC > /dev/null
> > Floating point exception (core dumped)
> > :/ #
> 
> We also have djvulibre in SUSE:SLE-15-SP2:Update and
> SUSE:ALP:Source:Standard:1.0.

Yeah, thanks.

Comment 4 Petr Gajdos 2023-08-29 10:49:31 UTC

BEFORE

TW,15sp2,15,12/djvulibre

:/ # c44 214672/POC > /dev/null
Floating point exception (core dumped)
:/ #


PATCH

https://sourceforge.net/p/djvu/bugs/344/#bcb7

Add similar checks as in IW44Image.cpp, see https://sourceforge.net/p/djvu/bugs/345/


AFTER

TW,15sp2,15,12/djvulibre

:/ # c44 214672/POC > /dev/null
*** IWBitmap: zero size image (corrupted file?)
*** (IW44EncodeCodec.cpp:1429)
*** 'void DJVU::IWBitmap::Encode::init(const DJVU::GBitmap&, DJVU::GP<DJVU::GBitmap>)'

:/ #

Comment 5 Petr Gajdos 2023-08-29 11:09:46 UTC

Submitted for TW,ALP,15sp2,15,12/djvulibre.

I believe all fixed.

Comment 6 OBSbugzilla Bot 2023-08-29 11:25:03 UTC

This is an autogenerated message for OBS integration:
This bug (1214672) was mentioned in
https://build.opensuse.org/request/show/1107914 Factory / djvulibre

Comment 8 Maintenance Automation 2023-09-05 12:42:12 UTC

SUSE-SU-2023:3520-1: An update that solves two vulnerabilities can now be installed.

Category: security (low)
Bug References: 1214670, 1214672
CVE References: CVE-2021-46310, CVE-2021-46312
Sources used:
openSUSE Leap 15.4 (src): djvulibre-3.5.27-150200.11.14.1
openSUSE Leap 15.5 (src): djvulibre-3.5.27-150200.11.14.1
Desktop Applications Module 15-SP4 (src): djvulibre-3.5.27-150200.11.14.1
Desktop Applications Module 15-SP5 (src): djvulibre-3.5.27-150200.11.14.1
SUSE Package Hub 15 15-SP4 (src): djvulibre-3.5.27-150200.11.14.1
SUSE Package Hub 15 15-SP5 (src): djvulibre-3.5.27-150200.11.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 9 Maintenance Automation 2023-09-25 12:30:02 UTC

SUSE-SU-2023:3755-1: An update that solves three vulnerabilities can now be installed.

Category: security (important)
Bug References: 1185895, 1214670, 1214672
CVE References: CVE-2021-32490, CVE-2021-46310, CVE-2021-46312
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): djvulibre-3.5.25.3-5.22.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): djvulibre-3.5.25.3-5.22.1
SUSE Linux Enterprise Server 12 SP5 (src): djvulibre-3.5.25.3-5.22.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): djvulibre-3.5.25.3-5.22.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.