A heap overflow can occur with crafted JPEG image file. (CVE-2023-27781) References: - https://bugs.mageia.org/show_bug.cgi?id=31764 - https://github.com/tjko/jpegoptim/issues/132 . MGASA-2023-0143 - Updated jpegoptim packages fix security vulnerability Publication date: 15 Apr 2023 URL: https://advisories.mageia.org/MGASA-2023-0143.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-27781 A heap overflow can occur with crafted JPEG image file. (CVE-2023-27781) References: - https://bugs.mageia.org/show_bug.cgi?id=31764 - https://github.com/tjko/jpegoptim/issues/132 - https://nvd.nist.gov/vuln/detail/CVE-2023-27781 - https://www.cve.org/CVERecord?id=CVE-2023-27781 SRPMS: - 8/core/jpegoptim-1.5.1-1.1.mga8 . Buffer overflow in pngcrush exposes security vulnerabilities. Upgrade to address risks and guarantee safe image compression.. Mageia, jpegoptim, heap overflow, security update. . Severity: Critical. LinuxSecurity.com Team
v1.5.3 - fix potential heap-buffer-overflow (read) when using stdin/stdout and processing corrupt JPEG. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-ee0bc9afb6 2023-04-04 00:16:16.774552 --------------------------------------------------------------------------------Name : jpegoptim Product : Fedora 38 Version : 1.5.3 Release : 1.fc38 URL : https://www.kokkonen.net/tjko/projects.html Summary : Utility to optimize JPEG files Description : Jpegoptim is an utility to optimize JPEG files. Provides lossless optimization (based on optimizing the Huffman tables) and "lossy" optimization based on setting maximum quality factor. --------------------------------------------------------------------------------Update Information: v1.5.3 - fix potential heap-buffer-overflow (read) when using stdin/stdout and processing corrupt JPEG --------------------------------------------------------------------------------ChangeLog: * Sat Mar 25 2023 Denis Fateyev - 1.5.3-1 - Update to version 1.5.3 --------------------------------------------------------------------------------References: [ 1 ] Bug #2169077 - jpegoptim-1.5.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=2169077 [ 2 ] Bug #2178809 - CVE-2023-27781 jpegoptim: Heap overflow in the optimize function at jpegoptim.c. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2178809 [ 3 ] Bug #2178810 - CVE-2023-27781 jpegoptim: Heap overflow in the optimize function at jpegoptim.c. [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2178810 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-ee0bc9afb6' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packagesare signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c. (CVE-2022-32325) References: - https://bugs.mageia.org/show_bug.cgi?id=31424 . MGASA-2023-0023 - Updated jpegoptim packages fix security vulnerability Publication date: 24 Jan 2023 URL: https://advisories.mageia.org/MGASA-2023-0023.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-32325 JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c. (CVE-2022-32325) References: - https://bugs.mageia.org/show_bug.cgi?id=31424 - https://lists.fedoraproject.org/archives/list/
v1.5.1 - fix logging to stdout when --stdout is used *thanks to Eta - update --treshold option accept decimal numbers as parameter - fix crashes when processing certain broken JPEG images - fix memory leaks - fix (logging) output in parallel processing mode. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-d9c91f39a5 2023-01-14 01:09:31.700570 --------------------------------------------------------------------------------Name : jpegoptim Product : Fedora 37 Version : 1.5.1 Release : 1.fc37 URL : https://www.kokkonen.net/tjko/projects.html Summary : Utility to optimize JPEG files Description : Jpegoptim is an utility to optimize JPEG files. Provides lossless optimization (based on optimizing the Huffman tables) and "lossy" optimization based on setting maximum quality factor. --------------------------------------------------------------------------------Update Information: v1.5.1 - fix logging to stdout when --stdout is used *thanks to Eta - update --treshold option accept decimal numbers as parameter - fix crashes when processing certain broken JPEG images - fix memory leaks - fix (logging) output in parallel processing mode --------------------------------------------------------------------------------ChangeLog: * Thu Jan 5 2023 Denis Fateyev - 1.5.1-1 - Update to version 1.5.1 --------------------------------------------------------------------------------References: [ 1 ] Bug #2112859 - CVE-2022-32325 jpegoptim: segmentation violation by a READ memory access at jpegoptim.c. [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2112859 [ 2 ] Bug #2158407 - jpegoptim-1.5.1 is available https://bugzilla.redhat.com/show_bug.cgi?id=2158407 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-d9c91f39a5' at thecommand line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.