Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2016-5139, CVE-2016-5152, CVE-2016-5158, CVE-2016-5159 #854

Closed
Gogil opened this issue Oct 4, 2016 · 7 comments
Closed

CVE-2016-5139, CVE-2016-5152, CVE-2016-5158, CVE-2016-5159 #854

Gogil opened this issue Oct 4, 2016 · 7 comments
Labels
bug

Comments

@Gogil
Copy link

Gogil commented Oct 4, 2016

Google fixed this code with:

CVE-2016-5139
Prevent integer overflows during calculation of |l_nb_precinct_size|
https://pdfium.googlesource.com/pdfium.git/+/2f6d1480a1be2b1f82c94219c2d99e67d7e0660d

CVE-2016-5152
Fix an integer overflow in opj_tcd_get_decoded_tile_size()
https://pdfium.googlesource.com/pdfium.git/+/d8cc503575463ff3d81b22dad292665f2c88911e

CVE-2016-5158
Prevent overflows when using opj_aligned_malloc()
https://pdfium.googlesource.com/pdfium.git/+/b20ab6c7acb3be1393461eb650ca8fa4660c937e

CVE-2016-5159
Prevent integer overflows during calculation of |l_nb_code_blocks_size|
https://pdfium.googlesource.com/pdfium.git/+/ff74356915d4c7f7c6eb16de1e9f403da4ecb6d5
@Gogil
Copy link
Author

Gogil commented Oct 4, 2016

CVE-2016-5158 is fixed: 9a07ccb

@nluedtke
Copy link

nluedtke commented Oct 4, 2016 •
edited
Loading

CVE-2016-5139 looks to be fixed with ea320da and issue #819

@nluedtke
Copy link

nluedtke commented Oct 4, 2016 •
edited
Loading

Gogil I think you mean CVE-2016-5159 is fixed with 9a07ccb and #841. Thats the one that deals with obj_aligned_malloc().

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5159

@Gogil
Copy link
Author

Gogil commented Oct 4, 2016

That's right.

@nluedtke
Copy link

nluedtke commented Oct 5, 2016 •
edited
Loading

For CVE-2016-5152 the vulnerable code does appear to be present in tcd.c.
For CVE-2016-5158 also appears to be in tcd.c, which leaves me to believe this are both open still.

@rouault
Copy link
Collaborator

rouault commented Jul 29, 2017

I believe all the checks of CVE-2016-5158 / https://pdfium.googlesource.com/pdfium.git/+/b20ab6c7acb3be1393461eb650ca8fa4660c937e/third_party/libopenjpeg20/0020-opj_aligned_malloc.patch are now in master

rouault added a commit that referenced this issue Jul 29, 2017
@rouault
opj_tcd_get_decoded_tile_size(): fix potential UINT32 overflow (#854, C…
3fbe713 
…VE-2016-5152)

Fix derived from https://pdfium.googlesource.com/pdfium.git/+/d8cc503575463ff3d81b22dad292665f2c88911e/third_party/libopenjpeg20/0018-tcd_get_decoded_tile_size.patch
@rouault
Copy link
Collaborator

rouault commented Jul 29, 2017

It seems all above mentionned issues are now fixed. Closing. Re-open if we missed something

@rouault rouault closed this as completed Jul 29, 2017
@detonin detonin added the bug label Aug 3, 2017
joebonrichie pushed a commit to solus-packages/openjpeg that referenced this issue Aug 15, 2023
@kyrios123 @JoshStrobl
Update openjpeg to 2.2.0 to address multiple CVEs
01687bc 
Summary:
This new release includes a significant number of improvements and bug fixes. In particular:
- Multi-threading support at decoding side
- Several speed optimisations both at encoder and decoder, and both on Wavelet
  Transform and Entropy Coding parts. On our test set, a single-threaded
  execution is now around 20% faster (encoding or decoding).
- Huge memory consumption reduction at decoding side (~60% reduction on
  large images)
- Several important bug fixes, in particular the one that was preventing
  OpenJPEG to encode lossless in some specific situations, as well as those
  related to mode switches (BYPASS/LAZY, RESTART/TERMALL, etc).
- Several security fixes thanks to the inclusion of OpenJPEG in the Google
  OSS Fuzz project.
Beside that, several improvements have been brought to the project maintenance, like inclusion of benchmarking scripts to compare speed with latest available kakadu binaries.

Security fixes:
- CVE-2016-5139, CVE-2016-5152, CVE-2016-5158, CVE-2016-5159 [#854](uclouvain/openjpeg#854)
- CVE-2016-1626 and CVE-2016-1628 [#850](uclouvain/openjpeg#850)

For more info check the [NEWS](https://github.com/uclouvain/openjpeg/blob/v2.2.0/NEWS.md) and the [Changelog](https://github.com/uclouvain/openjpeg/blob/v2.2.0/CHANGELOG.md)

Signed-off-by: Pierre-Yves <pyu@riseup.net>

Test Plan:
```
$ opj_compress -i test.png -o test.j2k

[INFO] tile number 1 / 1
[INFO] Generated outfile test.j2k
encode time: 283 ms
```

Reviewers: #triage_team, JoshStrobl

Reviewed By: #triage_team, JoshStrobl

Subscribers: sunnyflunk, JoshStrobl

Tags: #security

Differential Revision: https://dev.solus-project.com/D794
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@detonin @rouault @nluedtke @Gogil