Bug 48516

Summary: libjpeg-turbo: Multiple issues (4.2)
Product: UCS Reporter: Quality Assurance <qa>
Component: Security updatesAssignee: Quality Assurance <qa>
Status: CLOSED FIXED QA Contact: Philipp Hahn <hahn>
Severity: normal    
Priority: P3    
Version: UCS 4.2   
Target Milestone: UCS 4.2-5-errata   
Hardware: All   
OS: Linux   
What kind of report is it?: Security Issue What type of bug is this?: ---
Who will be affected by this bug?: --- How will those affected feel about the bug?: ---
User Pain: Enterprise Customer affected?:
School Customer affected?: ISV affected?:
Waiting Support: Flags outvoted (downgraded) after PO Review:
Ticket number: Bug group (optional):
Max CVSS v3 score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Description Quality Assurance univentionstaff 2019-01-23 09:50:08 CET 
New Debian libjpeg-turbo 1:1.3.1-12+deb8u1 fixes:
This update addresses the following issues:
* null pointer dereference in cjpeg (CVE-2016-3616)
* Divide by zero allows for denial of service via crafted BMP image  (CVE-2018-1152)
* Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)
* Segmentation fault in get_text_gray_row function in rdppm.c  (CVE-2018-11213)
* Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)
Comment 1 Quality Assurance univentionstaff 2019-01-23 10:00:48 CET 
--- mirror/ftp/4.2/unmaintained/4.2-0/source/libjpeg-turbo_1.3.1-12.dsc
+++ apt/ucs_4.2-0-errata4.2-5/source/libjpeg-turbo_1.3.1-12+deb8u1.dsc
@@ -1,3 +1,13 @@
+1:1.3.1-12+deb8u1 [Tue, 22 Jan 2019 20:46:50 +0100] Mike Gabriel <sunweaver@debian.org>:
+
+  * Non-maintainer upload by the LTS team.
+  * CVE-2018-11212: Check image size when reading targa file. Throw an
+    error when image width or height is 0.
+  * CVE-2018-11213, CVE-2018-11214: Check range of integer values in PPM
+    text file. Add checks to ensure values are within the specified range.
+    (This in theory also fixes unimportant-to-Debian issue CVE-2016-3616).
+  * CVE-2018-1152: tjLoadImage(): Fix FPE triggered by malformed BMP.
+
 1:1.3.1-12 [Sun, 08 Mar 2015 18:57:07 +0100] Ondřej Surý <ondrej@debian.org>:
 
   * No change upload to bump version in unstable

<http://10.200.17.11/4.2-5/#8264837960384791023>
Comment 2 Philipp Hahn univentionstaff 2019-01-23 10:44:39 CET 
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.2-5] 4ea59dd059 Bug #48516: libjpeg-turbo 1:1.3.1-12+deb8u1
 doc/errata/staging/libjpeg-turbo.yaml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
Comment 3 Arvid Requate univentionstaff 2019-01-23 14:35:19 CET 
<http://errata.software-univention.de/ucs/4.2/586.html>