[ GLSA 202003-23 ] libjpeg-turbo

[GLSA]

Gentoo Linux Security Advisory

Title: libjpeg-turbo: User-assisted execution of arbitrary code (GLSA 202003-23)
Severity: normal
Exploitable: local, remote
Date: 2020-03-15
Bug(s): #699830
ID: 202003-23

Synopsis

Several integer overflows in libjpeg-turbo might allow an attacker
to execute arbitrary code.


Background

libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.

Affected Packages

Package: media-libs/libjpeg-turbo
Vulnerable: < 2.0.3
Unaffected: >= 2.0.3
Architectures: All supported architectures


Description

It was discovered that libjpeg-turbo incorrectly handled certain JPEG
images.


Impact

A remote attacker could entice a user to open a specially crafted JPEG
file in an application linked against libjpeg-turbo, possibly resulting
in execution of arbitrary code with the privileges of the process or a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All libjpeg-turbo users should upgrade to the latest version: