[ GLSA 202010-03 ] libjpeg-turbo

[GLSA]

Gentoo Linux Security Advisory

Title: libjpeg-turbo: Information disclosure (GLSA 202010-03)
Severity: low
Exploitable: local, remote
Date: 2020-10-20
Bug(s): #727010
ID: 202010-03

Synopsis

An information disclosure vulnerability in libjpeg-turbo allow
remote attackers to obtain sensitive information.


Background

libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library.

Affected Packages

Package: media-libs/libjpeg-turbo
Vulnerable: < 2.0.4-r1
Unaffected: >= 1.5.3-r3
Unaffected: >= 2.0.4-r1
Architectures: All supported architectures


Description

It was discovered that libjpeg-turbo incorrectly handled certain PPM
files.


Impact

A remote attacker could entice a user to open a specially crafted PPM
file using an application linked against libjpeg-turbo, possibly allowing
attacker to obtain sensitive information.


Workaround

There is no known workaround at this time.

Resolution

All libjpeg-turbo 1.x users should upgrade to the latest version: