Bug 1006597 – VUL-0: CVE-2016-8882: jasper: segfault / null pointer access in jpc_pi_destroy

Bug 1006597 - (CVE-2016-8882) VUL-0: CVE-2016-8882: jasper: segfault / null pointer access in jpc_pi_destroy

(CVE-2016-8882)
Summary:	VUL-0: CVE-2016-8882: jasper: segfault / null pointer access in jpc_pi_destroy

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Fridrich Strba
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/173974/
Whiteboard:	CVSSv2:SUSE:CVE-2016-8882:4.4:(AV:L/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2016-10-24 16:04 UTC by Andreas Stieger
Modified:	2020-06-17 14:23 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Andreas Stieger 2016-10-24 16:04:33 UTC

https://github.com/mdadams/jasper/issues/30
segfault / null pointer access in jpc_pi_destroy

AddressSanitizer: SEGV on unknown address 0x000000000000

jpc_pi_destroy ... libjasper/jpc/jpc_t2cod.c:521:10

Reproducer: https://github.com/mdadams/jasper/files/532157/jasper-nullptr-jpc_pi_destroy.zip

Commit:
https://github.com/mdadams/jasper/commit/69a1439a5381e42b06ec6a06ed2675eb793babee

Fixed in git tag version-1.900.8 and up

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8882
http://seclists.org/oss-sec/2016/q4/220
http://seclists.org/oss-sec/2016/q4/216

Comment 1 Swamp Workflow Management 2016-10-24 22:01:12 UTC

bugbot adjusting priority

Comment 2 Swamp Workflow Management 2016-11-04 12:07:57 UTC

openSUSE-SU-2016:2722-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,392410,941919,942553,968373
CVE References: CVE-2008-3522,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8886
Sources used:
openSUSE 13.2 (src):    jasper-1.900.14-163.24.1

Comment 3 Swamp Workflow Management 2016-11-05 14:08:36 UTC

openSUSE-SU-2016:2737-1: An update that fixes 26 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,941919
CVE References: CVE-2008-3522,CVE-2011-4516,CVE-2011-4517,CVE-2014-8137,CVE-2014-8138,CVE-2014-8157,CVE-2014-8158,CVE-2014-9029,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
openSUSE 13.1 (src):    jasper-1.900.14-160.25.1

Comment 4 Swamp Workflow Management 2016-11-10 20:08:36 UTC

SUSE-SU-2016:2775-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2014-8158,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server 12-SP1 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    jasper-1.900.14-181.1

Comment 5 Swamp Workflow Management 2016-11-10 20:11:21 UTC

SUSE-SU-2016:2776-1: An update that fixes 19 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    jasper-1.900.14-134.25.1
SUSE Linux Enterprise Server 11-SP4 (src):    jasper-1.900.14-134.25.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    jasper-1.900.14-134.25.1

Comment 6 Swamp Workflow Management 2016-11-17 19:08:39 UTC

openSUSE-SU-2016:2833-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2014-8158,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
openSUSE Leap 42.2 (src):    jasper-1.900.14-167.1
openSUSE Leap 42.1 (src):    jasper-1.900.14-166.1

Comment 7 Marcus Meissner 2019-11-02 19:53:07 UTC

released