Headline

CVE-2022-40755: [BUG] Reachable assertion in inttobits, jas_image.c · Issue #338 · jasper-software/jasper

JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c.

2 years ago

CVE

Open in Source

#ubuntu #dos #c++#docker

summary

Hello, I was testing my fuzzer and found a reachable assertion in imginfo. An assertion in function inttobits can be reached when parsing a crafted jp2 file, when running ./imginfo -f $POC, as shown in the attachment

Environment

Ubuntu 22.04 (docker)
gcc/g++ 11.2.0
jasper latest commit 0c2a927

Step to reproduce

mkdir jasper-build && pushd jasper-build 
cmake -DJAS_ENABLE_SHARED=NO .. && make -j$(nproc)
./src/app/imginfo -f $POC

output

imginfo: /benchmark/jasper/src/libjasper/base/jas_image.c:1010: inttobits: Assertion `v >= 0 || sgnd' failed.
Aborted (core dumped)

POC

poc0.zip

Credit

Han Zheng (NCNIPC of China, Hexhive)
Yin Li, Xiaotong Jiao (NCNIPC of China)

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).