Ubuntu 16.04 & 14.04 ESM USN-5553-1: libjpeg-turbo DoS Issues

Several security issues were fixed in libjpeg-turbo.

Software Description:

- libjpeg-turbo: library for handling JPEG files

Details:

It was discovered that libjpeg-turbo was not properly handling EOF

characters,

which could lead to excessive memory consumption through the execution of a

large loop. An attacker could possibly use this issue to cause a denial of

service. (CVE-2018-11813)

It was discovered that libjpeg-turbo was not properly performing bounds

check operations, which could lead to a heap-based buffer overread. If a

user

or automated system were tricked into opening a specially crafted file, an

attacker could possibly use this issue to cause a denial of service. This

issue only affected Ubuntu 14.04 ESM. (CVE-2018-14498)

It was discovered that libjpeg-turbo was not properly limiting the amount of

main memory being consumed by the system during decompression or multi-pass

compression operations, which could lead to excessive memory consumpti...