Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in libjpeg-turbo
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in libjpeg-turbo
ID: SUSE-SU-2019:0711-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Module for Basesystem 15, SUSE Linux Enterprise Module for Desktop Applications 15, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Module for Packagehub Subpackages 15
Datum: Fr, 22. März 2019, 21:22
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11813
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14498
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1152
Applikationen: libjpeg-turbo

Originalnachricht


SUSE Security Update: Security update for libjpeg-turbo
______________________________________________________________________________

Announcement ID: SUSE-SU-2019:0711-1
Rating: moderate
References: #1096209 #1098155 #1128712
Cross-References: CVE-2018-1152 CVE-2018-11813 CVE-2018-14498

Affected Products:
SUSE Linux Enterprise Module for Packagehub Subpackages 15
SUSE Linux Enterprise Module for Open Buildservice
Development Tools 15
SUSE Linux Enterprise Module for Desktop Applications 15
SUSE Linux Enterprise Module for Basesystem 15
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:

This update for libjpeg-turbo fixes the following issues:

The following security vulnerabilities were addressed:

- CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row
function which could allow to an attacker to cause denial of service
(bsc#1128712).
- CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in
rdtarga.c, which allowed remote attackers to cause a denial-of-service
via crafted JPG files due to a large loop (bsc#1096209)
- CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c
caused by a divide by zero when processing a crafted BMP image
(bsc#1098155)


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Module for Packagehub Subpackages 15:

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-2019-711=1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15:

zypper in -t patch SUSE-SLE-Module-Development-Tools-OBS-15-2019-711=1

- SUSE Linux Enterprise Module for Desktop Applications 15:

zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2019-711=1

- SUSE Linux Enterprise Module for Basesystem 15:

zypper in -t patch SUSE-SLE-Module-Basesystem-15-2019-711=1



Package List:

- SUSE Linux Enterprise Module for Packagehub Subpackages 15 (aarch64
ppc64le s390x x86_64):

libjpeg-turbo-1.5.3-5.7.1
libjpeg-turbo-debuginfo-1.5.3-5.7.1
libjpeg-turbo-debugsource-1.5.3-5.7.1

- SUSE Linux Enterprise Module for Open Buildservice Development Tools 15
(aarch64 ppc64le s390x x86_64):

libjpeg-turbo-1.5.3-5.7.1
libjpeg-turbo-debuginfo-1.5.3-5.7.1
libjpeg-turbo-debugsource-1.5.3-5.7.1
libjpeg62-turbo-1.5.3-5.7.1
libjpeg62-turbo-debugsource-1.5.3-5.7.1

- SUSE Linux Enterprise Module for Desktop Applications 15 (x86_64):

libjpeg8-32bit-8.1.2-5.7.1
libjpeg8-32bit-debuginfo-8.1.2-5.7.1

- SUSE Linux Enterprise Module for Basesystem 15 (aarch64 ppc64le s390x
x86_64):

libjpeg62-62.2.0-5.7.1
libjpeg62-debuginfo-62.2.0-5.7.1
libjpeg62-devel-62.2.0-5.7.1
libjpeg8-8.1.2-5.7.1
libjpeg8-debuginfo-8.1.2-5.7.1
libjpeg8-devel-8.1.2-5.7.1
libturbojpeg0-8.1.2-5.7.1
libturbojpeg0-debuginfo-8.1.2-5.7.1


References:

https://www.suse.com/security/cve/CVE-2018-1152.html
https://www.suse.com/security/cve/CVE-2018-11813.html
https://www.suse.com/security/cve/CVE-2018-14498.html
https://bugzilla.suse.com/1096209
https://bugzilla.suse.com/1098155
https://bugzilla.suse.com/1128712

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung