Multiple vulnerabilities have been discovered in libjpeg-turbo, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libjpeg-turbo | * | < 2.1.1 | >= 2.1.1 |
libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.
Multiple vulnerabilities have been discovered in libjpeg-turbo. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All libjpeg-turbo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-2.1.1"
An information disclosure vulnerability in libjpeg-turbo allow remote attackers to obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libjpeg-turbo | * | < 2.0.4-r1 | >= 1.5.3-r3:0/0.1, >= 2.0.4-r1:0/0.2 |
libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.
It was discovered that libjpeg-turbo incorrectly handled certain PPM files.
A remote attacker could entice a user to open a specially crafted PPM file using an application linked against libjpeg-turbo, possibly allowing attacker to obtain sensitive information.
There is no known workaround at this time.
All libjpeg-turbo 1.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.5.3-r3:0/0.1"
All libjpeg-turbo 2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-2.0.4-r1:0/0.2"
Several integer overflows in libjpeg-turbo might allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libjpeg-turbo | * | < 2.0.3 | >= 2.0.3 |
libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.
It was discovered that libjpeg-turbo incorrectly handled certain JPEG images.
A remote attacker could entice a user to open a specially crafted JPEG file in an application linked against libjpeg-turbo, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All libjpeg-turbo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-2.0.3"
An out-of-bounds read in libjpeg-turbo might allow remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libjpeg-turbo | * | < 1.5.0 | >= 1.5.0 |
libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression.
The accelerated Huffman decoder was previously invoked if there were 128 bytes in the input buffer. However, it is possible to construct a JPEG image with Huffman blocks > 430 bytes in length. This release simply increases the minimum buffer size for the accelerated Huffman decoder to 512 bytes, which should accommodate any possible input.
A remote attacker could coerce the victim to run a specially crafted image file resulting in the execution of arbitrary code.
There is no known workaround at this time.
All libjpeg-turbo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.5.0"
Two vulnerabilities have been discovered in libjpeg-turbo, the worse of which could allow remote attackers access to sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libjpeg-turbo | * | < 1.4.2 | >= 1.4.2 |
libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library
libjpeg-turbo does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers.
Remote attackers could obtain sensitive information from uninitialized memory locations via a crafted JPEG images.
There is no known workaround at this time.
All libjpeg-turbo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.4.2"
A vulnerability in libjpeg-turbo could result in execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-libs/libjpeg-turbo | * | < 1.2.1 | >= 1.2.1 |
libjpeg-turbo accelerates JPEG compression and decompression.
A vulnerability in the get_sos() function in jdmarker.c could cause a heap-based buffer overflow.
A remote attacker could entice a user to open a specially crafted JPEG file in an application linked against libjpeg-turbo, possibly resulting in the remote execution of arbitrary code with the permissions of the user running the application, or Denial of Service.
There is no known workaround at this time.
All libjpeg-turbo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.2.1"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.