USN-5497-2: Libjpeg6b vulnerabilities
30 June 2022
Several security issues were fixed in Libjpeg6b.
Releases
Packages
- libjpeg6b - library for handling JPEG files
Details
USN-5497-1 fixed vulnerabilities in Libjpeg6b. This update provides
the corresponding updates for Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Libjpeg6b was not properly performing bounds
checks when compressing PPM and Targa image files. An attacker could
possibly use this issue to cause a denial of service.
(CVE-2018-11212)
Chijin Zhou discovered that Libjpeg6b was incorrectly handling the
EOF character in input data when generating JPEG files. An attacker
could possibly use this issue to force the execution of a large loop,
force excessive memory consumption, and cause a denial of service.
(CVE-2018-11813)
Sheng Shu and Dongdong She discovered that Libjpeg6b was not properly
limiting the amount of memory being used when it was performing
decompression or multi-pass compression operations. An attacker could
possibly use this issue to force excessive memory consumption and
cause a denial of service. (CVE-2020-14152)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
libjpeg62
-
1:6b2-2ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
Related notices
- USN-5336-1: libjpeg9-dev, libjpeg-progs, libjpeg9
- USN-5497-1: libjpeg62-dev, libjpeg62, libjpeg6b
- USN-5553-1: libjpeg-turbo-progs, libjpeg-turbo-test, libjpeg-turbo8-dev, libturbojpeg, libjpeg-turbo8, libjpeg-turbo
- USN-5631-1: libjpeg-turbo-progs, libjpeg-turbo-test, libjpeg-turbo8-dev, libturbojpeg0-dev, libturbojpeg, libjpeg-turbo8, libjpeg-turbo
- USN-3706-2: libjpeg-turbo8, libjpeg-turbo
- USN-3706-1: libjpeg-turbo-progs, libjpeg-turbo-test, libjpeg-turbo8-dev, libturbojpeg0-dev, libturbojpeg, libjpeg-turbo8, libjpeg-turbo