Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 699830 (CVE-2019-2201)

Summary: <media-libs/libjpeg-turbo-2.0.3: several integer overflows and subsequent segfaults when attempting to compress/decompress gigapixel images (CVE-2019-2201)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: IN_PROGRESS ---    
Severity: major CC: graphics, nobrowser
Priority: Normal Keywords: STABLEREQ
Version: unspecifiedFlags: stable-bot: sanity-check+
Hardware: All   
OS: Linux   
URL: https://source.android.com/security/bulletin/2019-11-01
Whiteboard: A2 [stable]
Package list:
media-libs/libjpeg-turbo-2.0.3
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2019-11-11 16:32:00 UTC
CVE-2019-2201 (https://nvd.nist.gov/vuln/detail/CVE-2019-2201):
  Several integer overflows and subsequent segfaults when attempting to
  compress/decompress gigapixel images.
Comment 1 Agostino Sarubbo gentoo-dev 2019-11-12 10:07:28 UTC
x86 stable
Comment 2 Agostino Sarubbo gentoo-dev 2019-11-12 10:13:52 UTC
sparc stable
Comment 3 Agostino Sarubbo gentoo-dev 2019-11-12 15:09:05 UTC
ppc64 stable
Comment 4 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-11-12 20:08:20 UTC
arm64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-11-13 07:41:28 UTC
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-11-13 07:45:43 UTC
amd64 stable
Comment 7 Rolf Eike Beer 2019-11-13 21:48:27 UTC
hppa stable
Comment 8 Agostino Sarubbo gentoo-dev 2019-11-14 11:57:59 UTC
ia64 stable
Comment 9 Matt Turner gentoo-dev 2019-11-17 07:22:02 UTC
alpha stable
Comment 10 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-22 09:37:36 UTC
arm stable
Comment 11 Ian Zimmerman 2019-12-16 18:37:06 UTC
I'd like to point out that in the announcement of this bug on oss-security [1], it says:

> integer overflow and subsequent heap corruption in libjpeg-turbo *2.0.3 and earlier*

(emph mine)

If that is right, a simple bump to 2.0.3 would not have fixed it in our distro.

I tried to follow the link to NIST, but there it is stated in term of Android versions only, and my eyes glaze over.  Sorry, please someone follow up.

[1]
https://www.openwall.com/lists/oss-security/2019/11/11/1