Alerts This Week
Warning Icon 1 626
Alerts This Week
Warning Icon 1 626

openSUSE 42.3: openSUSE-SU-2019:1343-1 Moderate: libjpeg-turbo DOS Risks

opensuse
Calendar Grey May 8, 2019
Dist Opensuse Esm H88
This patch for openSUSE addresses buffer over-read and DOS vulnerabilities in libjpeg-turbo, enhancing security for JPEG image handling
An update that fixes three vulnerabilities is now available.

Description

This update for libjpeg-turbo fixes the following issues:

The following security vulnerabilities were addressed:

- CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row

function which could allow to an attacker to cause denial of service

(bsc#1128712).

- CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in

rdtarga.c, which allowed remote attackers to cause a denial-of-service

via crafted JPG files due to a large loop (bsc#1096209)

- CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c

caused by a divide by zero when processing a crafted BMP image

(bsc#1098155)

This update was imported from the SUSE:SLE-12:Update update project.

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-1343=1

Package List

- openSUSE Leap 42.3 (i586 x86_64):

libjpeg-turbo-1.5.3-45.1

libjpeg-turbo-debuginfo-1.5.3-45.1

libjpeg-turbo-debugsource-1.5.3-45.1

libjpeg62-62.2.0-45.1

libjpeg62-debuginfo-62.2.0-45.1

libjpeg62-devel-62.2.0-45.1

libjpeg62-turbo-1.5.3-45.1

libjpeg62-turbo-debugsource-1.5.3-45.1

libjpeg8-8.1.2-45.1

libjpeg8-debuginfo-8.1.2-45.1

libjpeg8-devel-8.1.2-45.1

libturbojpeg0-8.1.2-45.1

libturbojpeg0-debuginfo-8.1.2-45.1

- openSUSE Leap 42.3 (x86_64):

libjpeg62-32bit-62.2.0-45.1

libjpeg62-debuginfo-32bit-62.2.0-45.1

libjpeg62-devel-32bit-62.2.0-45.1

libjpeg8-32bit-8.1.2-45.1

libjpeg8-debuginfo-32bit-8.1.2-45.1

libjpeg8-devel-32bit-8.1.2-45.1

libturbojpeg0-32bit-8.1.2-45.1

libturbojpeg0-debuginfo-32bit-8.1.2-45.1

References

https://www.suse.com/security/cve/CVE-2018-1152.html

https://www.suse.com/security/cve/CVE-2018-11813.html

https://www.suse.com/security/cve/CVE-2018-14498.html

https://bugzilla.suse.com/1096209

https://bugzilla.suse.com/1098155

https://bugzilla.suse.com/1128712

--

Announcement ID: openSUSE-SU-2019:1343-1
Rating: moderate
Affected Products: openSUSE Leap 42.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here