Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 699830 (CVE-2019-2201) - <media-libs/libjpeg-turbo-2.0.3: several integer overflows and subsequent segfaults when attempting to compress/decompress gigapixel images (CVE-2019-2201)
Summary: <media-libs/libjpeg-turbo-2.0.3: several integer overflows and subsequent seg...
Status: RESOLVED FIXED
Alias: CVE-2019-2201
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major
Assignee: Gentoo Security
URL: https://source.android.com/security/b...
Whiteboard: A2 [glsa+ cve]
Keywords:
: 727910 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-11-11 16:32 UTC by GLSAMaker/CVETool Bot
Modified: 2020-10-18 00:26 UTC (History)
3 users (show)

See Also:
Package list:
media-libs/libjpeg-turbo-2.0.3
Runtime testing required: ---
stable-bot: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2019-11-11 16:32:00 UTC 
CVE-2019-2201 (https://nvd.nist.gov/vuln/detail/CVE-2019-2201):
  Several integer overflows and subsequent segfaults when attempting to
  compress/decompress gigapixel images.
Comment 1 Agostino Sarubbo gentoo-dev 2019-11-12 10:07:28 UTC 
x86 stable
Comment 2 Agostino Sarubbo gentoo-dev 2019-11-12 10:13:52 UTC 
sparc stable
Comment 3 Agostino Sarubbo gentoo-dev 2019-11-12 15:09:05 UTC 
ppc64 stable
Comment 4 Aaron Bauman (RETIRED) gentoo-dev 2019-11-12 20:08:20 UTC 
arm64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2019-11-13 07:41:28 UTC 
ppc stable
Comment 6 Agostino Sarubbo gentoo-dev 2019-11-13 07:45:43 UTC 
amd64 stable
Comment 7 Rolf Eike Beer archtester 2019-11-13 21:48:27 UTC 
hppa stable
Comment 8 Agostino Sarubbo gentoo-dev 2019-11-14 11:57:59 UTC 
ia64 stable
Comment 9 Matt Turner gentoo-dev 2019-11-17 07:22:02 UTC 
alpha stable
Comment 10 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2019-11-22 09:37:36 UTC 
arm stable
Comment 11 Ian Zimmerman 2019-12-16 18:37:06 UTC 
I'd like to point out that in the announcement of this bug on oss-security [1], it says:

> integer overflow and subsequent heap corruption in libjpeg-turbo *2.0.3 and earlier*

(emph mine)

If that is right, a simple bump to 2.0.3 would not have fixed it in our distro.

I tried to follow the link to NIST, but there it is stated in term of Android versions only, and my eyes glaze over.  Sorry, please someone follow up.

[1]
https://www.openwall.com/lists/oss-security/2019/11/11/1
Comment 12 Thomas Deutschmann (RETIRED) gentoo-dev 2020-03-15 04:49:17 UTC 
@ Ian: This bug is about CVE-2019-2201 which is linked to https://github.com/libjpeg-turbo/libjpeg-turbo/commit/2a9e3bd7430cfda1bc812d139e0609c6aca0b884 and this commit is present in v2.0.3. I guess the CVE text is not correct. If you have any other information, please share.

New GLSA request filed.
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2020-03-15 14:29:34 UTC 
This issue was resolved and addressed in
 GLSA 202003-23 at https://security.gentoo.org/glsa/202003-23
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 14 Thomas Deutschmann (RETIRED) gentoo-dev 2020-10-18 00:26:43 UTC 
*** Bug 727910 has been marked as a duplicate of this bug. ***