BugTraq
[ MDVSA-2013:273 ] libjpeg Nov 21 2013 12:11PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:273
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : libjpeg
Date : November 21, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated libjpeg packages fix security vulnerabilities:

libjpeg 6b and libjpeg-turbo will use uninitialized memory when
decoding images with missing SOS data for the luminance component
(Y) in presence of valid chroma data (Cr, Cb) (CVE-2013-6629).

libjpeg-turbo will use uninitialized memory when handling Huffman
tables (CVE-2013-6630).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6630
http://advisories.mageia.org/MGASA-2013-0333.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
4b3246c5236cce36539c5a3f3383e141 mbs1/x86_64/jpeg-progs-1.2.0-5.2.mbs1.x86_64.rpm
e903e2d84d5975c84feb30bf61e9fc27 mbs1/x86_64/lib64jpeg62-1.2.0-5.2.mbs1.x86_64.rpm
ed2b02157825d772109fd321a4bd8da5 mbs1/x86_64/lib64jpeg8-1.2.0-5.2.mbs1.x86_64.rpm
6257733e093dc32b01a6e9fe695f75c5 mbs1/x86_64/lib64jpeg-devel-1.2.0-5.2.mbs1.x86_64.rpm
f5880a061f6ffe706c92619516cdb483 mbs1/x86_64/lib64jpeg-static-devel-1.2.0-5.2.mbs1.x86_64.rpm
e9d23e700d88863fa51623fa318e9203 mbs1/SRPMS/libjpeg-1.2.0-5.2.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSjc42mqjQ0CJFipgRAjjdAKCyA6j70X2L2kyFbcb+Lf9DfvdGzQCgjN3I
zZpqCNbcAEXpDneYn4hAA/o=
=5rwB
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus