Out of bounds read while decoding JPG images

Out of bounds read while decoding JPG images

Announced

April 29, 2014

Reporter

Abhishek Arya

Impact

Moderate

Products

Firefox, Firefox ESR, SeaMonkey, Thunderbird

Fixed in

• Firefox 29
• Firefox ESR 24.5
• SeaMonkey 2.26
• Thunderbird 24.5

Description

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a fixed offset out of bounds read issue while decoding specifically formatted JPG format images. This causes a non-exploitable crash.

References

• Heap-buffer-overflow in read_u32 (CVE-2014-1523)