USN-5553-1

Dashboard / Vulnerabilities / USN-5553-1

USN-5553-1

Summary: libjpeg-turbo vulnerabilities

Details: It was discovered that libjpeg-turbo was not properly handling EOF characters, which could lead to excessive memory consumption through the execution of a large loop. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-11813) It was discovered that libjpeg-turbo was not properly performing bounds check operations, which could lead to a heap-based buffer overread. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-14498) It was discovered that libjpeg-turbo was not properly limiting the amount of main memory being consumed by the system during decompression or multi-pass compression operations, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-14152) It was discovered that libjpeg-turbo was not properly setting variable sizes when performing certain kinds of encoding operations, which could lead to a stack-based buffer overflow. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2020-17541)

References: https://ubuntu.com/security/notices/USN-5553-1, https://ubuntu.com/security/CVE-2018-11813, https://ubuntu.com/security/CVE-2018-14498, https://ubuntu.com/security/CVE-2020-14152, https://ubuntu.com/security/CVE-2020-17541