huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-7466: Qemu: usb: xhci memory leakage during device unplug
Component: Qemu
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2016-09-13T00:00:00+00:00

A memory-leak flaw was found in the Quick Emulator(QEMU) built with USB xHCI controller emulation support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly resulted in leaking host memory, which affected other services on the host. A privileged user inside the guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's QEMU process instance.


Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: b53dd4495ced2432a0b652ea895e651d07336f7e
CVE-2016-7545: policycoreutils: SELinux sandbox escape via TIOCSTI ioctl
Component: policycoreutils
Severity: Important
CVSS v3: 8.6 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2016-09-22T00:00:00+00:00

It was found that the sandbox tool provided in policycoreutils was vulnerable to a TIOCSTI ioctl attack. A specially crafted program executed via the sandbox command could use this flaw to execute arbitrary commands in the context of the parent shell, escaping the sandbox.


Affected upstream versions: n/a
Fixed upstream versions: secilc-2.6
Upstream repository: https://github.com/SELinuxProject/selinux
Upstream fix commit: acca96a135a4d2a028ba9b636886af99c0915379
CVE-2016-7797: pacemaker: pacemaker remote nodes vulnerable to hijacking, resulting in a DoS attack
Component: pacemaker
Severity: Moderate
CVSS v3: 8.6 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2016-02-22T00:00:00+00:00

It was found that the connection between a pacemaker cluster and a pacemaker_remote node could be shut down using a new unauthenticated connection. A remote attacker could use this flaw to cause a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: Pacemaker-1.1.15
Upstream repository: https://github.com/ClusterLabs/pacemaker
Upstream fix commit: 5ec24a2642bd0854b884d1a9b51d12371373b410
CVE-2016-7910: kernel: Use after free in seq file
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-08-04T00:00:00+00:00

A flaw was found in the Linux kernel's implementation of seq_file where a local attacker could manipulate memory in the put() function pointer. This could lead to memory corruption and possible privileged escalation.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code which can trigger the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.8
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 77da160530dd1dc94f6ae15a981f24e5f0021e84
CVE-2016-7913: kernel: media: use-after-free in [tuner-xc2028] media driver
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-01-28T00:00:00+00:00

The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code with the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8dfbcc4351a0b6d2f2d77f367552f48ffefafe18
CVE-2016-7914: kernel: assoc_array: don't call compare_object() on a node
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2016-04-06T00:00:00+00:00

The assoc_array_insert_into_terminal_node() function in 'lib/assoc_array.c' in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6 as the code with the flaw is not present in the products listed.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2 as the flaw was already fixed in the products listed.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2
CVE-2016-7915: kernel: HID: core: prevent out-of-bound readings
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 2.1 (CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Public date: 2016-01-19T00:00:00+00:00

The hid_input_field() function in 'drivers/hid/hid-core.c' in the Linux kernel before 4.6 allows physically proximate attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) by connecting a device.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2 as the flaw was already fixed in the products listed.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 50220dead1650609206efe91f0cc116132d59b3f
CVE-2016-7977: ghostscript: .libfile does not honor -dSAFER
Component: ghostscript
Severity: Moderate
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2016-09-28T00:00:00+00:00

It was found that ghostscript function .libfile did not honor the -dSAFER option, usually used when processing untrusted documents, leading to information disclosure. A specially crafted postscript document could, in the context of the gs process, retrieve file content on the target machine.


Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 8abd22010eb4db0fb1b10e430d5f5d83e015ef70
CVE-2016-8576: Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch
Component: Qemu
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2016-10-06T00:00:00+00:00

The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.


Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 05f43d44e4bc26611ce25fd7d726e483f73363ce
CVE-2016-8602: ghostscript: check for sufficient params in .sethalftone5
Component: ghostscript
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L)
Public date: 2016-10-08T00:00:00+00:00

It was found that ghostscript did not sufficiently check the validity of parameters given to the .sethalftone5 function. A specially crafted postscript document could cause a crash, or execute arbitrary code in the context of the gs process.


Affected upstream versions: n/a
Fixed upstream versions: gpdf_gs_text_filter_000
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: f5c7555c303
CVE-2016-8610: SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
Component: SSL/TLS
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-10-24T00:00:00+00:00

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Statement: This flaw affects applications that are compiled against OpenSSL or GnuTLS and do not allocate an extra thread for processing ClientHello messages. Nginx is affected by this issue; Apache httpd is not affected by this issue. This issue has been rated as having a security impact of Moderate. It requires an attacker to send a very large amount of SSL ALERT messages to the host network connection. This issue can also be mitigated by configuring firewalls to limit the number of connections per IP address, or use deep packet inspection to reject these type of alert packets. A future update may address this issue.

Affected upstream versions: All 0.9.8, All 1.0.1, 1.0.2 through 1.0.2h, 1.1.0
Fixed upstream versions: OpenSSL_1_1_1
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: af58be768ebb690f78530f796e92b8ae5c9a4401
CVE-2016-8630: kernel: kvm: x86: NULL pointer dereference during instruction decode
Component: kernel
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.2 (CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2016-11-02T00:00:00+00:00

Linux kernel built with the Kernel-based Virtual Machine (CONFIG_KVM) support is vulnerable to a null pointer dereference flaw. It could occur on x86 platform, when emulating an undefined instruction. An attacker could use this flaw to crash the host kernel resulting in DoS.

Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the version of Linux kernel as shipped with Red Hat Enterprise
Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this
issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d9092f52d7e61dd1557f2db2400ddb430e85937e
CVE-2016-8633: kernel: Buffer overflow in firewire driver via crafted incoming packets
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.8 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-11-06T00:00:00+00:00

A buffer overflow vulnerability due to a lack of input filtering of incoming fragmented datagrams was found in the IP-over-1394 driver [firewire-net] in a fragment handling code in the Linux kernel. The vulnerability exists since firewire supported IPv4, i.e. since version 2.6.31 (year 2009) till version v4.9-rc4. A maliciously formed fragment with a respectively large datagram offset would cause a memcpy() past the datagram buffer, which would cause a system panic or possible arbitrary code execution.

The flaw requires [firewire-net] module to be loaded and is remotely exploitable from connected firewire devices, but not over a local network.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG 2.x. This issue has been rated as having Moderate security impact. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 667121ace9dbafb368618dbabcf07901c962ddac
CVE-2016-8645: kernel: a BUG() statement can be hit in net/ipv4/tcp_input.c
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 6.2 (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-11-10T00:00:00+00:00

It was discovered that the Linux kernel since 3.6-rc1 with 'net.ipv4.tcp_fastopen' set to 1 can hit BUG() statement in tcp_collapse() function after making a number of certain syscalls leading to a possible system crash.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code which can trigger the flaw is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ac6e780070e30e4c35bd395acfe9191e6268bdd3
CVE-2016-8646: kernel: Oops in shash_async_export()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-11-15T00:00:00+00:00

A vulnerability was found in the Linux kernel. An unprivileged local user could trigger oops in shash_async_export() by attempting to force the in-kernel hashing algorithms into decrypting an empty data set.

Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 as the code creating this issue is not present in the products listed.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.4
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 4afa5f9617927453ac04b24b584f6c718dfb4f45
CVE-2016-8650: kernel: Null pointer dereference via keyctl
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 8.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Public date: 2016-11-15T00:00:00+00:00

A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7, MRG-2 and realtime kernels.

This issue does not affect kernels that ship with Red Hat Enterprise Linux 5.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: f5527fffff3f002b0a6b376163613b82f69de073
CVE-2016-8654: jasper: heap-based buffer overflow in QMFB code in JPC codec
Component: jasper
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-11-25T00:00:00+00:00

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.


Affected upstream versions: 2.0.0
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a
CVE-2016-8655: kernel: Race condition in packet_set_ring leads to use after free
Component: kernel
Severity: Important
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-12-06T00:00:00+00:00

A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKET_V3 ring buffer. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system.

Statement: This issue does not affect Red Hat Enterprise Linux 5 and 6.

This issue does affect Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2. Future updates for the respective releases will address this issue.

In a default or common use of Red Hat Enterprise Linux 7 this issue does not allow an unprivileged local user elevate their privileges on the system.

In order to exploit this issue the attacker needs CAP_NET_RAW capability, which needs to be granted by the administrator to the attacker's account. Since Red Hat Enterprise Linux 7 does not have unprivileged user namespaces enabled by default, local unprivileged users also cannot abuse namespaces to grant this capability to themselves and elevate their privileges.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 84ac7260236a49c79eede91617700174c2c19b0c
CVE-2016-8666: kernel: Remotely triggerable recursion in GRE code leading to kernel crash
Component: kernel
Severity: Important
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-10-13T00:00:00+00:00

A flaw was found in the way the Linux kernel's networking subsystem handled offloaded packets with multiple layers of encapsulation in the GRO (Generic Receive Offload) code path. A remote attacker could use this flaw to trigger unbounded recursion in the kernel that could lead to stack corruption, resulting in a system crash.


Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: fac8e0f579695a3ecbc4d3cac369139d7f819971
CVE-2016-8669: Qemu: char: divide by zero error in serial_update_parameters
Component: Qemu
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 3 (CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L)
Public date: 2016-10-12T00:00:00+00:00

The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divide-by-zero error and QEMU process crash) via vectors involving a value of divider greater than baud base.


Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: 3592fe0c919cf27a81d8e9f9b4f269553418bb01
CVE-2016-8690: jasper: missing jas_matrix_create() parameter checks
Component: jasper
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-10-15T00:00:00+00:00

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 8f62b4761711d036fd8964df256b938c809b7fca
CVE-2016-8691: jasper: missing SIZ marker segment XRsiz and YRsiz fields range check
Component: jasper
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-15T00:00:00+00:00

The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: d8c2604cd438c41ec72aff52c16ebd8183068020
CVE-2016-8692: jasper: missing SIZ marker segment XRsiz and YRsiz fields range check
Component: jasper
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2016-10-15T00:00:00+00:00

The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: d8c2604cd438c41ec72aff52c16ebd8183068020
CVE-2016-8693: jasper: incorrect handling of bufsize 0 in mem_resize()
Component: jasper
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-10-15T00:00:00+00:00

Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 44a524e367597af58d6265ae2014468b334d0309
CVE-2016-8740: httpd: Incomplete handling of LimitRequestFields directive in mod_http2
Component: httpd
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.9 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-12-04T00:00:00+00:00

A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash.

Statement: Red Hat Product Security has rated this issue as having Low security
impact. This issue is not currently planned to be addressed in future
updates. For additional information, refer to the Issue Severity
Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: 2.4.17 - 2.4.23
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: 29c63b786ae028d82405421585e91283c8fa0da3
CVE-2016-8884: jasper: missing jas_matrix_create() parameter checks
Component: jasper
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-10-15T00:00:00+00:00

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.


Affected upstream versions: n/a
Fixed upstream versions: mdadams-experimental-version-1
Upstream repository: https://github.com/mdadams/jasper
Upstream fix commit: 5d66894d2313e3f3469f19066e149e08ff076698