Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 699830 (CVE-2019-2201) - <media-libs/libjpeg-turbo-2.0.3: several integer overflows and subsequent segfaults when attempting to compress/decompress gigapixel images (CVE-2019-2201)
Summary: <media-libs/libjpeg-turbo-2.0.3: several integer overflows and subsequent seg...
Status: IN_PROGRESS
Alias: CVE-2019-2201
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://source.android.com/security/b...
Whiteboard: A2 [stable]
Keywords: STABLEREQ
Depends on:
Blocks:
 
Reported: 2019-11-11 16:32 UTC by GLSAMaker/CVETool Bot
Modified: 2019-12-16 18:37 UTC (History)
2 users (show)

See Also:
Package list:
media-libs/libjpeg-turbo-2.0.3
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-11-11 16:32:00 UTC
CVE-2019-2201 (https://nvd.nist.gov/vuln/detail/CVE-2019-2201):
  Several integer overflows and subsequent segfaults when attempting to
  compress/decompress gigapixel images.
Comment 1 Agostino Sarubbo gentoo-dev 2019-11-12 10:07:28 UTC
x86 stable
Comment 2 Agostino Sarubbo gentoo-dev 2019-11-12 10:13:52 UTC
sparc stable
Comment 3 Agostino Sarubbo gentoo-dev 2019-11-12 15:09:05 UTC
ppc64 stable
Comment 4 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2019-11-12 20:08:20 UTC
arm64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-11-13 07:41:28 UTC
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-11-13 07:45:43 UTC
amd64 stable
Comment 7 Rolf Eike Beer 2019-11-13 21:48:27 UTC
hppa stable
Comment 8 Agostino Sarubbo gentoo-dev 2019-11-14 11:57:59 UTC
ia64 stable
Comment 9 Matt Turner gentoo-dev 2019-11-17 07:22:02 UTC
alpha stable
Comment 10 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2019-11-22 09:37:36 UTC
arm stable
Comment 11 Ian Zimmerman 2019-12-16 18:37:06 UTC
I'd like to point out that in the announcement of this bug on oss-security [1], it says:

> integer overflow and subsequent heap corruption in libjpeg-turbo *2.0.3 and earlier*

(emph mine)

If that is right, a simple bump to 2.0.3 would not have fixed it in our distro.

I tried to follow the link to NIST, but there it is stated in term of Android versions only, and my eyes glaze over.  Sorry, please someone follow up.

[1]
https://www.openwall.com/lists/oss-security/2019/11/11/1