Joined: 12 May 2004
|Posted: Sun Mar 15, 2020 3:26 pm Post subject: [ GLSA 202003-23 ] libjpeg-turbo
|Gentoo Linux Security Advisory
Title: libjpeg-turbo: User-assisted execution of arbitrary code (GLSA 202003-23)
Exploitable: local, remote
Several integer overflows in libjpeg-turbo might allow an attacker
to execute arbitrary code.
libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.
Vulnerable: < 2.0.3
Unaffected: >= 2.0.3
Architectures: All supported architectures
It was discovered that libjpeg-turbo incorrectly handled certain JPEG
A remote attacker could entice a user to open a specially crafted JPEG
file in an application linked against libjpeg-turbo, possibly resulting
in execution of arbitrary code with the privileges of the process or a
Denial of Service condition.
There is no known workaround at this time.
All libjpeg-turbo users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-2.0.3"