Bug 727908 (CVE-2020-14151, CVE-2020-14152, CVE-2020-14153)

Summary:	<media-libs/jpeg-9d: Multiple vulnerabilities (CVE-2020-{14151,14152,14153})
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	maintainer-needed
Priority:	Normal	Flags:	nattka: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://github.com/gentoo/gentoo/pull/16183
Whiteboard:	B3 [noglsa cve]
Package list:	=media-libs/jpeg-9d	Runtime testing required:	---

Description Sam James archtester

2020-06-11 04:42:20 UTC

Relevant exerpts from the changelog for 9d (attached, not easy to find online other than src):

"rdtarga.c: use read_byte(), with EOF check, instead of getc()
in read_*_pixel().
Thank to Chijin Zhou for cjpeg potential vulnerability report.

jmemnobs.c: respect the max_memory_to_use setting in
jpeg_mem_available() computation.  Thank to Sheng Shu and
Dongdong She for djpeg potential vulnerability report.

Avoid out of bounds array read (AC derived table pointers)
in start pass in jdhuff.c.  Thank to Peng Li for report."

Comment 1 Sam James archtester

2020-06-11 04:43:02 UTC

Needs bump to 9d.

Comment 2 Larry the Git Cow gentoo-dev

2020-06-13 16:42:40 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5c2d010380c06ab188d0c46fd21b9a83159a2374

commit 5c2d010380c06ab188d0c46fd21b9a83159a2374
Author:     Sam James (sam_c) <sam@cmpct.info>
AuthorDate: 2020-06-10 23:59:40 +0000
Commit:     Mike Gilbert <floppym@gentoo.org>
CommitDate: 2020-06-13 16:41:58 +0000

    media-libs/jpeg: Security bump to 9d
    
    Bug: https://bugs.gentoo.org/727908
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Sam James (sam_c) <sam@cmpct.info>
    Signed-off-by: Mike Gilbert <floppym@gentoo.org>
    Closes: https://github.com/gentoo/gentoo/pull/16183

 media-libs/jpeg/Manifest       |  1 +
 media-libs/jpeg/jpeg-9d.ebuild | 71 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)

Comment 3 Sam James archtester

2020-06-13 22:51:51 UTC

arm64 stable

Comment 4 Sergei Trofimovich (RETIRED) gentoo-dev

2020-06-14 20:23:40 UTC

ppc/ppc64 stable

Comment 5 Agostino Sarubbo gentoo-dev

2020-06-15 15:05:24 UTC

arm stable

Comment 6 Agostino Sarubbo gentoo-dev

2020-06-15 15:10:37 UTC

s390 stable

Comment 7 Agostino Sarubbo gentoo-dev

2020-06-15 15:13:27 UTC

sparc stable

Comment 8 Rolf Eike Beer archtester

2020-06-19 14:18:46 UTC

hppa stable

Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev

2020-06-20 13:50:03 UTC

x86 stable

Comment 10 Mikle Kolyada (RETIRED) archtester

2020-06-29 16:08:34 UTC

amd64 stable

Comment 11 Larry the Git Cow gentoo-dev

2020-07-16 01:06:13 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ff3214301f4015791a9d77d37e42a8d46e44af01

commit ff3214301f4015791a9d77d37e42a8d46e44af01
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2020-07-16 00:22:23 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2020-07-16 01:01:30 +0000

    media-libs/jpeg: security cleanup
    
    Bug: https://bugs.gentoo.org/727908
    Package-Manager: Portage-2.3.99, Repoman-2.3.23
    Signed-off-by: Sam James <sam@gentoo.org>

 media-libs/jpeg/Manifest                          |  4 --
 media-libs/jpeg/files/jpeg-8d-CVE-2013-6629.patch | 17 ------
 media-libs/jpeg/jpeg-6b-r12.ebuild                | 47 ---------------
 media-libs/jpeg/jpeg-8d-r2.ebuild                 | 51 ----------------
 media-libs/jpeg/jpeg-9c.ebuild                    | 71 -----------------------
 5 files changed, 190 deletions(-)