Bug 21627 - openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[01], CVE-2017-14164)
Summary: openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[0...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA5-64-OK MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2017-08-29 02:27 CEST by David Walser
Modified: 2017-12-31 16:15 CET (History)
4 users (show)

See Also:
Source RPM: openjpeg2-2.2.0-1.1.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-08-29 02:27:43 CEST
Three security issues fixed upstream in openjpeg2 have been announced today (August 28):
http://www.openwall.com/lists/oss-security/2017/08/28/2
http://www.openwall.com/lists/oss-security/2017/08/28/3
http://www.openwall.com/lists/oss-security/2017/08/28/4

Upstream commits to fix the issues are linked in the messages above.

Mageia 5 and Mageia 6 are also affected.
David Walser 2017-08-29 02:28:49 CEST

Whiteboard: (none) => MGA6TOO, MGA5TOO

Comment 1 Marja Van Waes 2017-08-29 23:57:48 CEST
Assigning to the registered maintainer.

CC: (none) => marja11
Assignee: bugsquad => rverschelde

Comment 2 David Walser 2017-09-01 14:44:15 CEST
CVE-2017-14039 and CVE-2017-1404[01] assigned:
http://www.openwall.com/lists/oss-security/2017/09/01/2
http://www.openwall.com/lists/oss-security/2017/09/01/3
http://www.openwall.com/lists/oss-security/2017/09/01/4

Summary: openjpeg2: 3 more new security issues fixed upstream => openjpeg2: 3 more new security issues fixed upstream (CVE-2017-14039 and CVE-2017-1404[01])

Comment 3 David Walser 2017-09-06 12:01:57 CEST
Two more:
http://openwall.com/lists/oss-security/2017/09/06/1
http://openwall.com/lists/oss-security/2017/09/06/2

Summary: openjpeg2: 3 more new security issues fixed upstream (CVE-2017-14039 and CVE-2017-1404[01]) => openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[01], CVE-2017-1415[12])

Comment 4 David Walser 2017-09-07 11:59:36 CEST
Fedora has issued an advisory for this on September 6:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VR3TBOFMLYHDDTJXBEYBJEUSQNNUEBQ5/
Comment 5 David Walser 2017-09-07 18:32:14 CEST
CVE-2017-14164 assigned for incomplete fix for CVE-2017-14152 (so we needn't list CVE-2017-14164 in our advisory, but we need the fix for it from the message below):
http://openwall.com/lists/oss-security/2017/09/06/3

Summary: openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[01], CVE-2017-1415[12]) => openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[01], CVE-2017-1415[12], CVE-2017-14164)

Comment 6 David Walser 2017-10-10 15:56:55 CEST
openSUSE has issued an advisory for this today (October 10):
https://lists.opensuse.org/opensuse-updates/2017-10/msg00032.html
Comment 7 Rémi Verschelde 2017-10-25 12:03:38 CEST
Sorry for the delay, I've had a lot of bugs@ notification backlog lately. I'll have a look asap.
Comment 8 David Walser 2017-12-28 18:29:08 CET
CVE-2017-1415[12] were fixed in Bug 21572, so we do need to list CVE-2017-14164 in the advisory.

Advisory:
========================

Updated openjpeg2 packages fix security vulnerabilities:

A heap-based buffer overflow was discovered in the opj_t2_encode_packet
function. The vulnerability caused an out-of-bounds write, which may have lead
to remote denial of service or possibly unspecified other impact
(CVE-2017-14039).

An invalid write access was discovered in bin/jp2/convert.c, triggering a crash
in the tgatoimage function. The vulnerability may have lead to remote denial of
service or possibly unspecified other impact (CVE-2017-14040).

A stack-based buffer overflow was discovered in the pgxtoimage function. The
vulnerability caused an out-of-bounds write, which may have lead to remote
denial of service or possibly remote code execution (CVE-2017-14041).

A size-validation issue was discovered in opj_j2k_write_sot. The vulnerability
caused an out-of-bounds write, which may have lead to remote DoS or possibly
remote code execution (CVE-2017-14164).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14039
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14041
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14164
https://lists.opensuse.org/opensuse-updates/2017-10/msg00032.html
========================

Updated packages in core/updates_testing:
========================
openjpeg2-2.2.0-1.2.mga5
libopenjp2_7-2.2.0-1.2.mga5
libopenjpeg2-devel-2.2.0-1.2.mga5
openjpeg2-2.2.0-1.2.mga6
libopenjp2_7-2.2.0-1.2.mga6
libopenjpeg2-devel-2.2.0-1.2.mga6

from SRPMS:
openjpeg2-2.2.0-1.2.mga5.src.rpm
openjpeg2-2.2.0-1.2.mga6.src.rpm

Summary: openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[01], CVE-2017-1415[12], CVE-2017-14164) => openjpeg2 new security issues fixed upstream (CVE-2017-14039, CVE-2017-1404[01], CVE-2017-14164)
Assignee: rverschelde => qa-bugs
Whiteboard: MGA6TOO, MGA5TOO => MGA5TOO
Version: Cauldron => 6

Comment 9 Thomas Andrews 2017-12-30 00:12:12 CET
Question:

My 64-bit M5 KDE system has jasper installed by default. It does not currently have openjpeg2 installed. If I am to attempt a test of openjpeg, should I remove jasper, or is it OK if I have the two installed side-by-side?

Or would it be better if I left this one to someone else?

CC: (none) => andrewsfarm

Comment 10 David Walser 2017-12-30 00:20:54 CET
They are both primarily libraries, used by whichever applications use them, which is mutually exclusive.  They live side by side just fine.  They don't concern each other.
Comment 11 Thomas Andrews 2017-12-30 01:44:38 CET
OK, then. I've installed it, and viewed a jp2 file with several apps, but I am unsure if openjpeg2 was used on any of them.

No regressions noted, but I am unsure if this test is good enough to give an OK for 64-bit.
Comment 12 David Walser 2017-12-30 01:54:06 CET
"urpmq --whatrequires lib64openjp2_7" shows that this library is used by imagemagick, lib64gs9 (aka ghostscript), and mupdf on Mageia 5.
Comment 13 Thomas Andrews 2017-12-30 02:27:46 CET
Used ImageMagick to view the jp2 image. No problems noted.

Giving it the OK for Mga5.

Whiteboard: MGA5TOO => MGA5TOO MGA5-64-OK

Comment 14 Lewis Smith 2017-12-30 14:14:55 CET
(In reply to Thomas Andrews from comment #11)
> OK, then. I've installed it, and viewed a jp2 file with several apps, but I
> am unsure if openjpeg2 was used on any of them.
To find out whether any particular library is used by an application, start it from the command line via  'strace'. Try
 $ strace -h                   [for help; -o is the main thing]
If you use it without any output parameter, it spills tons of info on the console. You can direct this to a file with the -o option, then after closing the application, you can search this file with 'less' for important strings like "open" or the library name. I have found the following method avoids the need for a separate file:
 $ strace <the command> 2>&1 | grep <whatever>
This limits normal console O/P to whatever you grep for. One complication with libraries is exactly how they will be logged - not necessarily like the pkg name. 

Here is an example (display = ImageMagick):
 $ strace display bell_206.jp2 2>&1 | grep libopenjp2
 open("/lib64/libopenjp2.so.7", O_RDONLY|O_CLOEXEC) = 4
(Normally it is 3 at the end). The terminal '7' corresponds with the end of the pkg name: libopenjp2_7. All this shows is that the library is invoked, but it is all we can easily do.

This usage is rather important where libraries are involved, and do not have (as is sometimes the case) a related command-line program to drive them, often called xxx-utils. Perhaps this warrants a ML post?
Comment 15 David Walser 2017-12-30 14:31:04 CET
If you run ldd on the binary executable and it shows the library, it's a guarantee it will open it (strace is useful to catch dlopen()'d libraries which ldd doesn't show).  If urpmq --whatrequires on the library shows a package, it is most likely because ldd on one of the binaries in the package showed that it is linked to that library.
Comment 16 Thomas Andrews 2017-12-31 02:48:47 CET
Installed in 64-bit Mga6, opened same jp2 image as in Comment 13.

No issues noted.

Giving this the Mga6 OK.

Whiteboard: MGA5TOO MGA5-64-OK => MGA5TOO MGA5-64-OK MGA6-64-OK

Dave Hodgins 2017-12-31 14:02:04 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 17 Lewis Smith 2017-12-31 14:10:27 CET
Many thanks TJ for both releases. Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 18 Mageia Robot 2017-12-31 16:15:35 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2017-0481.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.