|
Date: Wed, 11 Sep 2013 19:19:50 -0700 From: Seth Arnold <seth.arnold@...onical.com> To: oss-security@...ts.openwall.com Subject: [seth.arnold@...onical.com: CVE Requests openjpeg] Please find attached three mails relating to the openjpeg (http://www.openjpeg.org/) libopenjpeg library (Debian/Ubuntu source package name openjpeg) JPEG 2000 image processing library. CVE-2013-4289 has been assigned for heap-based buffer overflows. CVE-2013-4290 has been assigned for stack-based buffer overflows. When I reviewed our packages, I followed several of the memory-allocation multiplications far enough to convince myself that integer wraparound was possible, though perhaps the example I selected for the CVE request is not an actual problem. I have also attached an email I sent directly to the openjpeg developers with suggestions for further enhancements that did not feel worty of a CVE request. I'm including it here in the hopes that it is useful to someone. I did not receive any replies from the openjpeg developers; as far as I know, no patches are available, and I personally will not be taking the time to prepare patches. If someone does take the time to prepare patches, I'd like to suggest writing several wrappers around malloc() to handle the common memory allocation cases so the size validation can be performed in a handful of routines rather than scattered through the codebase. Thanks to Huzaifa Sidhpurwala for his assistence deciphering my request. Thanks, Seth Content of type "message/rfc822" skipped Content of type "message/rfc822" skipped Content of type "message/rfc822" skipped Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.