This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============9185835134119879366==
Content-Language: en-CA
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------uPUyFuJ33nfbhxDpAyjvzoiy"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------uPUyFuJ33nfbhxDpAyjvzoiy
Content-Type: multipart/mixed;
 boundary="------------8nPB5xAGqCA5engvm3gzI9WO";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <45b4ccd3-254c-877e-7906-fdcac5d31b8c@canonical.com>
Subject: [USN-5631-1] libjpeg-turbo vulnerabilities

--------------8nPB5xAGqCA5engvm3gzI9WO
Content-Type: text/plain; charset=UTF-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-5631-1
September 22, 2022

libjpeg-turbo vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in libjpeg-turbo.

Software Description:
- libjpeg-turbo: library for handling JPEG files

Details:

It was discovered that libjpeg-turbo incorrectly handled certain EOF
characters. An attacker could possibly use this issue to cause
libjpeg-turbo to consume resource, leading to a denial of service. This
issue only affected Ubuntu 18.04 LTS. (CVE-2018-11813)

It was discovered that libjpeg-turbo incorrectly handled certain malformed
jpeg files. An attacker could possibly use this issue to cause
libjpeg-turbo to crash, resulting in a denial of service. (CVE-2020-17541,
CVE-2020-35538)

It was discovered that libjpeg-turbo incorrectly handled certain malformed
PPM files. An attacker could use this issue to cause libjpeg-turbo to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-46822)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  libjpeg-turbo8                  2.0.3-0ubuntu1.20.04.3
  libturbojpeg                    2.0.3-0ubuntu1.20.04.3

Ubuntu 18.04 LTS:
  libjpeg-turbo8                  1.5.2-0ubuntu5.18.04.6
  libturbojpeg                    1.5.2-0ubuntu5.18.04.6

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5631-1
  CVE-2018-11813, CVE-2020-17541, CVE-2020-35538, CVE-2021-46822

Package Information:
  https://launchpad.net/ubuntu/+source/libjpeg-turbo/2.0.3-0ubuntu1.20.04.3
  https://launchpad.net/ubuntu/+source/libjpeg-turbo/1.5.2-0ubuntu5.18.04.6

--------------8nPB5xAGqCA5engvm3gzI9WO--

--------------uPUyFuJ33nfbhxDpAyjvzoiy
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmMspfgACgkQZWnYVadE
vpOKeA//U14Nh1DggfgHFLqaYKxf3fCzhzYCU+i6x/hMWGWT6j+zLO4QOX4iJW6F
VrpRs9pe4c58WUO2PooenDDsQ3CIR0WLeZFaQLm94Iea5pNdT3+Fshzg6ipwmNYN
wtpOjk57o5A8v9fH5hgZwE2AQ3QOAxZ4QxFavPVCyZPNDwBVR4ry3lwiCNyQMpLg
VqALARUaK4Jko93V2v/HU/B2ZyhNpUFomdZY6CUm0pqZ1JGkzhSBuefE027aM/hs
JFK5bCpmlzzM2Cj2BaPGPcmMz96+f2HN1NlMf4y7jIJ/dVIoZJ49BVl+9JiVmyTn
PQkOT0wvKoAhhJgjVAurHWTOBg0gMvprG5uVLRyJlkc2jvykDa/GD2yKNW0nKfgF
0sgoUmdZOo9/D4/cGEKqYsI5kfAsuwYnnwwEdrjU8nZxbkiihK6xmINIP6igmRrL
7p4lUny+Bka10AvbZxQjcWbXfoymd1UShRQHiUpWSuQ5+mim2TDPI8ED2JV3c96Q
2JWur3u1JQl7ezhpYCMQXdaKj/HLnIm6E92oFKW/ejEp5MFRPAjbj9JPwbMomAA2
hy5fuAQK4r5FJaQRjLUtGNA9IGVejtYhVV5T07myQNNeLM/UeyUvqlPhU6xmWsZe
r7XlntHV1lm/j/9Knr90FxepjLH9eFsLdn4St6iZCK0WYntKUnk=
=7kMU
-----END PGP SIGNATURE-----

--------------uPUyFuJ33nfbhxDpAyjvzoiy--


--===============9185835134119879366==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============9185835134119879366==--