Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2628
libjpeg-turbo security update
3 August 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libjpeg-turbo
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14152 CVE-2020-13790 CVE-2018-14498
CVE-2018-1152
Reference: ESB-2020.2007
ESB-2019.4267
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2302-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/
July 31, 2020 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : libjpeg-turbo
Version : 1:1.5.1-2+deb9u1
CVE ID : CVE-2018-1152 CVE-2018-14498 CVE-2020-13790 CVE-2020-14152
Debian Bug : 902950 924678 962829
Several vulnerabilities were fixed in libjpeg-turbo,
a widely used library for handling JPEG files.
CVE-2018-1152
Denial of service vulnerability caused by a divide by zero when
processing a crafted BMP image in TJBench.
CVE-2018-14498
Denial of service (heap-based buffer over-read and application
crash) via a crafted 8-bit BMP in which one or more of the color
indices is out of range for the number of palette entries.
CVE-2020-13790
Heap-based buffer over-read via a malformed PPM input file.
CVE-2020-14152
jpeg_mem_available() did not honor the max_memory_to_use setting,
possibly causing excessive memory consumption.
For Debian 9 stretch, these problems have been fixed in version
1:1.5.1-2+deb9u1.
We recommend that you upgrade your libjpeg-turbo packages.
For the detailed security status of libjpeg-turbo please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libjpeg-turbo
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAl8kYtUACgkQiNJCh6LY
mLEI4A//ZSRkBmcgBfAISfFItnREpK4GLA/wfEza8IYh0AT1N5hRmOdEwwR0noCB
VLAlLXTo9DM05rlJxI/EkqK5MthFqg25CQhgz9mGpJANrgmvFbwNvNxx9Iw6IsHs
V46uKPf62GFeCjsCcXvNjR2x8Q5oRrf0xCZrO/cVCdvS/8sNKCF+8GscXKJCQxzY
adWYAgTGJh+UuMJksgINP0aIbVv2kmQR58FhjUgJiNfxg15Vhkzzwf6M15B6yUx8
idNqNDSUcg29V7QTOiFd9Fg/JSfRGAzgflvcZK7/qVIhxdWsn9ZDRFwnTkHo5cO3
G+tExD1q7QGsk8Udz0Da8U2N+D/Qywc++iRTaI7omFVZer1tBwc6il7Vi1STKi0L
xPmsjwdKux6So+wgSn6at/GafIXcLFqkCCP9+wGR9hcIRoWiHGTfA7jxcuWyv6Lq
s5Mcp7kMsjAijvu7VSoU+Ur7lI0E3/PnjjiF7AX6GWVshG0zCZWQI/Ziy31h5piY
bDoqsT5RDs8+F1WgmCBsbaFcqDQKHng2lb+z3eTgcYuyFYsuco0y/0CTyjRg3Yi/
iTQi8PRIyQotW/bcohO5xY37zC2qfLeNXFY3Csdr7VliVZo0eMB3sVJnHMO1Pqob
CB0cUCQDiJ8TTVaGfM9rhqlozgSbMXOLzfjXhjtzwO2Pm6VlOOo=
=JzVH
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXydWTeNLKJtyKPYoAQj0VA/9Ev2C1iwJu9c62pfPmGxbgG2xju16/5NV
ZDAxvzIcbdQO4BAYjMB4JecW1N59DU8ix7owDCTMOtBhYQE6DJzRpqy1eFe3sY/4
HB9yenoQsj875cHE+mRQl8VA8ZC8NMCp2K9rVg3DgavAVZjpCQkxYNslTxyVlU0L
UjcROmMdSlrjiaxTlGd2gRP0KDMDDQ4HlmgbzaxTI9wS74gTCvNHKvPwW8WAXnHY
medfVnSZgRNkjbuTQwPpXuYTx+/ofC/r72h3e8ccKwJgbmoKl5GWQ5IGplBUdd/I
YynKeTci7Upmf3ZTAIRR06wGKJuG7S9E7WB5NkxfSaOsMpso7ejfxgj9wf6akEGl
C6Zx9iObOpjkPQqA7Hv79EEZCmsOjCu64+z1yNAIPwwg2go/prlipuLbdeqilviz
VhQvIwZULrjlKufcHQ6TpE6Ri4+om9VC84Q/r1z9E5pBfWkRdEBnvj2hSWqx8jrA
uxSiO+VZV9XcVTSmQxV9Pu/U38MvzrfrCRQm/YSsTpC5CKHQ2sedFp071OHSbPQu
8EtutkMnxfG28YoWuv/PDN0PenI2d5/vW3TXMkzYYiLzGcBogAD1C7jmaPjagP0t
tV0P+YXwTvpjI1DXG2CO3+b3ZSqPGvrtaZhUFNcON8qFdzyk0xSJHeyA+4GfKmVc
ImALydqhgr4=
=y4iH
-----END PGP SIGNATURE-----