oss-security - Re: CVE request: libgpf: use-after-free vulnerability in Decoder.cpp

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 25 Aug 2015 13:25:53 -0400 (EDT)
From: cve-assign@...re.org
To: pcheng@....com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: libgpf: use-after-free vulnerability in Decoder.cpp

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> An use-after-free issue in Decoder.cpp was reported to upstream. The
> problem is due to lack of validation of ColorTableSize.
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1251749
> https://sourceforge.net/p/libpgf/code/147/
> https://sourceforge.net/p/libpgf/code/148/

We think you mean that a use-after-free can occur when the
http://sourceforge.net/p/libpgf/code/HEAD/tree/trunk/libpgf/INSTALL
instructions are followed. Use CVE-2015-6673.

https://sourceforge.net/p/libpgf/code/147/ seems to be a series of
changes for handling failed input validation by propagating an error
status, rather than by using assert calls. Typically these cases do
not have CVE IDs (see the
http://openwall.com/lists/oss-security/2014/11/28/8 post). When
writing a general-purpose open-source library, it is often best not to
rely on assert calls, because someone may not realize their role, and
may decide to adapt the library code and integrate it into their own
build process that uses NDEBUG.

There can be a CVE ID for behavior of a library with NDEBUG if any of
these are true:

  - the author doesn't provide build instructions

  - the build instructions always or sometimes use NDEBUG

  - there's other information suggesting that NDEBUG is acceptable
    (e.g., "all of the asserts are for impossible conditions that were
    only relevant during development")

  - the author intended to support use of NDEBUG

or possibly a few other similar conditions (e.g., end users would
reasonably guess that NDEBUG was acceptable based on the author's past
practices or on how the library is used).

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJV3KRBAAoJEL54rhJi8gl58a8P/jBFCHH5anrDKTyqXxxBk/AI
638SN+O/ve3CssNmXk75E75i5+bZhJvuXpGWDPx3Ew3B5ijlaJ0tzDr5+LXJeo7L
OcKTTB1FuepD/5BwittRW1HQDS1X83247tbHpKWNqZVWfMaJb92NU0MTyvB8kU/K
modDPxBoY06+aMJvS+p489BfZYMi97/H1mkwGFEekuFEZsET9PA8l0a/Or3Jcbv+
ObdpXWkbiOYlrLJPfPBXFwZ3zRlx3PgRpVfqeB60u0PAU4WW+ZkQdN4ZqntqAwet
6NkfLKcqaMEkcsGNT82lh6eQXbReJS0UWVegE5HJcOu+weAkjjMkxsv6gydeUvEW
fChjJ3uinsUifb29XXJ1ofROQhQ1kHxOckiXWKh2MY6ThDXbSPVwPvVnFtzHDZuw
BXomIDpLeXcXnXBwtXx6esXQ1WM82BvwKcvnY5kR1crrM6xXUOOpnjf7fnzL/nWn
DTZWM6vhmOH21vNX6D7V6oHRkn056R5xxZmpK/MH6p30Dt3hSDUds+BMziC2RerL
7urAVKCbebZOFU4wIJC+78cqcuh6kTost+8nlsqSr6GSstICbgqxk19D9MWGtzRF
gFo4z8b/x1709jNMowqnCkLnHnDkDbhw3AJ5Plu05sMoQpyR+QizYKC447lQQwIo
0rrvxnRcjdvtIgzFQiAk
=7Eio
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.