Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Debian 9: DLA-2302-1 Critical: libjpeg-turbo Denial Of Service

debian lts
Calendar Grey July 31, 2020
Dist Debian Esm H88
Important updates have been issued for OpenSSL in response to various security issues. Keep your Ubuntu system protected!
Several vulnerabilities were fixed in libjpeg-turbo, a widely used library for handling JPEG files
Topics%20covered

Topics Covered

security advisory denial of service debian memory consumption libjpeg-turbo

Summary

CVE-2018-1152

Denial of service vulnerability caused by a divide by zero when
processing a crafted BMP image in TJBench.

CVE-2018-14498

Denial of service (heap-based buffer over-read and application
crash) via a crafted 8-bit BMP in which one or more of the color
indices is out of range for the number of palette entries.

CVE-2020-13790

Heap-based buffer over-read via a malformed PPM input file.

CVE-2020-14152

jpeg_mem_available() did not honor the max_memory_to_use setting,
possibly causing excessive memory consumption.

For Debian 9 stretch, these problems have been fixed in version
1:1.5.1-2+deb9u1.

We recommend that you upgrade your libjpeg-turbo packages.

For the detailed security status of libjpeg-turbo please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/libjpeg-turbo

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Package: libjpeg-turbo
Version: 1:1.5.1-2+deb9u1
CVE ID: CVE-2018-1152 CVE-2018-14498 CVE-2020-13790 CVE-2020-14152
Debian Bug: 902950 924678 962829

Topics%20covered

Topics Covered

security advisory denial of service debian memory consumption libjpeg-turbo

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here