Docker circleci/node:12.16.0-browsers-legacy

Overview

In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.

References

• ADVISORY
• CONFIRM
• Debian Security Tracker
• Gentoo Security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• REDHAT
• RHSA Security Advisory
• Security Focus

Overview

The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next, during "readelf -a" execution.

References

• Debian Security Tracker
• Gentoo Security Advisory
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21990

Overview

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

References

• CONFIRM
• Debian Security Tracker
• Exploit DB
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker

Overview

The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.

References

• ADVISORY
• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• REDHAT
• RHSA Security Advisory
• Security Focus
• Ubuntu CVE Tracker

Overview

In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in malloc() with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

References

• ADVISORY
• Debian Security Tracker
• Gentoo Security Advisory
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker

Overview

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpret a -1 value as a sorting count instead of an error flag, which allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

References

• Debian Security Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=22148

Overview

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.

References

• CONFIRM
• Debian Security Tracker
• MISC
• REDHAT
• Security Focus

Overview

The bfd_make_section_with_flags function in section.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a NULL dereference via a crafted file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a group section that is too small.

References

• Debian Security Tracker
• Security Focus
• Ubuntu CVE Tracker
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=0c54f69295208331faab9bc5e995111a35672f9b

Overview

The elf_read_notesfunction in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

References

• Debian Security Tracker
• Gentoo Security Advisory
• Security Focus
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21933

Overview

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, do not ensure a unique PLT entry for a symbol, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, related to elf32-i386.c and elf64-x86-64.c.

References

• Debian Security Tracker
• https://blogs.gentoo.org/ago/2017/09/25/binutils-heap-based-buffer-overflow-in-_bfd_x86_elf_get_synthetic_symtab-elfxx-x86-c/
• https://sourceware.org/bugzilla/show_bug.cgi?id=22170
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=56933f9e3e90eebf1018ed7417d6c1184b91db6b
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=61e3bf5f83f7e505b6bc51ef65426e5b31e6e360

Overview

The evax_bfd_print_emh function in vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The _bfd_xcoff_read_ar_hdr function in bfd/coff-rs6000.c and bfd/coff64-rs6000.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds stack read via a crafted COFF image file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21786

Overview

The bfd_mach_o_i386_canonicalize_one_reloc function in bfd/mach-o-i386.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted mach-o file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The _bfd_vms_slurp_eeom function in libbfd.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The _bfd_vms_slurp_egsd function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an arbitrary memory read via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The nlm_swap_auxiliary_headers_in function in bfd/nlmcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted nlm file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The read_symbol_stabs_debugging_info function in rddbg.c in GNU Binutils 2.29 and earlier allows remote attackers to cause an out of bounds heap read via a crafted binary file.

References

• Debian Security Tracker
• Gentoo Security Advisory
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The alpha_vms_object_p function in bfd/vms-alpha.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted vms alpha file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21813

Overview

The bfd_mach_o_read_symtab_strtab function in bfd/mach-o.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap write and possibly achieve code execution via a crafted mach-o file.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21840

Overview

The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.

References

• Debian Security Tracker
• Ubuntu CVE Tracker
• https://sourceware.org/bugzilla/show_bug.cgi?id=21787

Overview

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

References

• BUGTRAQ
• BUGTRAQ
• CONFIRM
• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• FREEBSD
• MISC
• MISC
• MISC
• MISC
• MLIST
• MLIST
• MLIST
• MLIST
• SUSE
• SUSE
• SUSE
• SUSE
• UBUNTU
• UBUNTU
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. An application may be able to gain elevated privileges.

References

• Debian Security Tracker
• MISC
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Arbitrary Code Injection curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• ADVISORY
• MISC
• MISC

Overview

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

References

• ADVISORY
• BUGTRAQ
• CONFIRM
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MISC
• N/A
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

References

• ADVISORY
• BUGTRAQ
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• GENTOO
• MISC
• MISC
• N/A
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• CONFIRM
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MLIST

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• CONFIRM
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MISC
• MLIST

Overview

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

References

• BUGTRAQ
• CONFIRM
• CONFIRM
• CONFIRM
• CVE Details
• DEBIAN
• Debian Security Tracker
• Fedora Security Update
• GENTOO
• MISC
• MISC
• MLIST
• N/A
• Netapp Security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Use After Free. Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.

Remediation

Upgrade curl to version or higher.

References

• ADVISORY
• GENTOO
• MISC
• MISC

Overview

Affected versions of this package are vulnerable to Use After Free. A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

Remediation

Upgrade dbus to version or higher.

References

• ADVISORY
• MISC

Overview

DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.

References

• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• FEDORA
• FEDORA
• MISC
• MISC
• SUSE
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.

References

• CONFIRM
• CONFIRM
• CONFIRM
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• FEDORA
• UBUNTU

Overview

do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

do_core_note in readelf.c in libmagic.a in file 5.35 allows remote attackers to cause a denial of service (stack corruption and application crash) or possibly have unspecified other impact.

References

• CVE Details
• Debian Security Announcement
• Debian Security Tracker
• MISC
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

References

• CONFIRM
• Debian Security Tracker
• MISC

Overview

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain "Private->RunningCode - 2" array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

References

• Debian Security Tracker
• GitHub Issue
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

The DGifDecompressLine function in dgif_lib.c in GIFLIB (possibly version 3.0.x), as later shipped in cgif.c in sam2p 0.49.4, has a heap-based buffer overflow because a certain CrntCode array index is not checked. This will lead to a denial of service or possibly unspecified other impact.

References

• Debian Security Tracker
• GitHub Issue
• Security Focus
• Ubuntu CVE Tracker

Overview

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.

References

• Apple Security Advisory
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• GitHub Advisory
• GitHub Commit
• MISC
• MISC
• OSS security Advisory
• OSS security Advisory
• OSS security Advisory
• OpenSuse Security Announcement
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix for that bug still left the door open for an exploit where some credential is leaked (but the attacker cannot control which one). Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are considered illegal as of the recently published Git versions can cause Git to send a "blank" pattern to helpers, missing hostname and protocol fields. Many helpers will interpret this as matching any URL, and will return some unspecified stored password, leaking the password to an attacker's server. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The root of the problem is in Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the vulnerability in practice depends on which helpers are in use. Credential helpers which are known to trigger the vulnerability: - Git's "store" helper - Git's "cache" helper - the "osxkeychain" helper that ships in Git's "contrib" directory Credential helpers which are known to be safe even with vulnerable versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to trigger the vulnerability.

References

• CONFIRM
• Debian Security Announcement
• Debian Security Tracker
• FULLDISC
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• GitHub Advisory
• GitHub Advisory
• GitHub Commit
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types. An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

Remediation

There is no fixed version for glib2.0.

References

• ADVISORY
• MISC
• MISC

Overview

Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types. An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

Remediation

There is no fixed version for glib2.0.

References

• ADVISORY
• MISC

Overview

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• MISC
• Netapp Security Advisory
• Ubuntu CVE Tracker

Overview

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• GENTOO
• MISC
• MISC
• MISC
• MISC
• Netapp Security Advisory
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

References

• CONFIRM
• Debian Bug Report
• Debian Security Tracker
• Netapp Security Advisory
• Oracle Security Advisory
• REDHAT
• RHSA Security Advisory
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

References

• Debian Security Tracker
• Exploit DB
• Exploit DB
• MISC
• Netapp Security Advisory
• Oss-Sec Mailing List
• RHSA Security Advisory
• Security Focus
• Security Tracker
• Ubuntu CVE Tracker
• Ubuntu Security Advisory
• Ubuntu Security Advisory

Overview

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• Netapp Security Advisory

Overview

An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

References

• ADVISORY
• Debian Security Tracker
• GENTOO
• MISC
• Netapp Security Advisory
• RedHat Bugzilla Bug
• UBUNTU

Overview

Affected versions of this package are vulnerable to Reachable Assertion. The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Remediation

There is no fixed version for glibc.

References

• ADVISORY
• MISC
• MISC
• MLIST

Overview

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

References

• CONFIRM
• CONFIRM
• Debian Security Tracker
• GENTOO
• Netapp Security Advisory
• RedHat Bugzilla Bug
• UBUNTU
• Ubuntu CVE Tracker

Overview

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

References

• Debian Security Tracker
• MISC
• MISC
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate verification API. Any client or server application that verifies X.509 certificates with GnuTLS 3.5.8 or later is affected.

References

• CONFIRM
• CONFIRM
• CVE Details
• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• MISC
• OpenSuse Security Announcement
• REDHAT
• RedHat Bugzilla Bug
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In libgraphite2 in graphite2 1.3.11, a NULL pointer dereference vulnerability was found in Segment.cpp during a dumbRendering operation, which may allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ttf file.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GitHub Commit
• GitHub Issue
• Ubuntu CVE Tracker

Overview

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

References

• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• FEDORA
• Fedora Security Update
• Fedora Security Update
• Gentoo Security Advisory
• GitHub Commit
• GitHub PR
• MISC
• MISC
• MISC
• MISC
• MISC
• RHSA Security Advisory
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.

References

• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadSUNImage in coders/sun.c, which allows attackers to cause a denial of service.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to cause a denial of service.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

WriteEPTImage in coders/ept.c in ImageMagick 7.0.7-25 Q16 allows remote attackers to cause a denial of service (MagickCore/memory.c double free and application crash) or possibly have unspecified other impact via a crafted file.

References

• CVE Details
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the WriteJP2Image function in coders/jp2.c.

References

• DEBIAN
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the SyncImageSettings function in MagickCore/image.c. This is related to AcquireImage in magick/image.c.

References

• DEBIAN
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-34 has a "use of uninitialized value" vulnerability in the ReadPANGOImage function in coders/pango.c.

References

• DEBIAN
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned long. This would most likely lead to an impact to application availability, but could potentially cause other problems related to undefined behavior. This flaw affects ImageMagick versions prior to 7.0.8-69.

Remediation

There is no fixed version for imagemagick.

References

• ADVISORY
• MISC

Overview

In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/opencl.c because a program-lookup result is not checked, related to CacheOpenCLKernel.

References

• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

The AcquireResampleFilterThreadSet function in magick/resample-private.h in ImageMagick 7.0.7-4 mishandles failed memory allocation, which allows remote attackers to cause a denial of service (NULL Pointer Dereference in DistortImage in MagickCore/distort.c, and application crash) via unspecified vectors.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulnerability occurs because a memory allocation result is not checked, related to GetOpenCLCacheDirectory.

References

• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker may use this flaw to read beyond the end of the buffer or to crash the program.

References

• Debian Security Tracker
• GitHub Commit
• MLIST
• OpenSuse Security Announcement
• RedHat Bugzilla Bug
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, related to "Conditional jump or move depends on uninitialised value(s)."

References

• Debian Security Announcement
• Debian Security Tracker
• Gentoo Security Advisory
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.8-40 Q16, there is a heap-based buffer over-read in the function WritePNMImage of coders/pnm.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file. This is related to SetGrayscaleImage in MagickCore/quantize.c.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• SUSE
• SUSE
• Security Focus
• UBUNTU
• Ubuntu CVE Tracker

Overview

The ReadTIFFImage function in coders/tiff.c in ImageMagick 7.0.7-26 Q16 does not properly restrict memory allocation, leading to a heap-based buffer over-read.

References

• CVE Details
• Debian Security Tracker
• GitHub Issue
• MLIST
• Security Focus
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.

References

• CVE Details
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_profile and LocaleNCompare.

References

• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Write. Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.

Remediation

Upgrade imagemagick to version or higher.

References

• ADVISORY
• MISC
• MLIST

Overview

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption.

References

• CVE Details
• Debian Security Tracker
• GitHub Issue
• MLIST
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.

References

• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.

References

• CVE Details
• DEBIAN
• DEBIAN
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.

References

• CVE Details
• DEBIAN
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.

References

• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Issue
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function format8BIM, which allows attackers to cause a denial of service.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the function ReadTIFFImage, which allows attackers to cause a denial of service.

References

• Debian Security Tracker
• Fedora Security Update
• Fedora Security Update
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

coders/mat.c in ImageMagick 7.0.8-43 Q16 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by crafting a Matlab image file that is mishandled in ReadImage in MagickCore/constitute.c.

References

• ADVISORY
• DEBIAN
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Issue
• SUSE
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.

References

• CONFIRM
• CONFIRM
• CVE Details
• DEBIAN
• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• GitHub Commit
• GitHub Issue
• MLIST
• OpenSuse Security Announcement
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to XML Injection. ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

Remediation

Upgrade imagemagick to version or higher.

References

• ADVISORY
• GENTOO
• MISC
• MISC
• MLIST

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion. MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Remediation

Upgrade krb5 to version or higher.

References

• ADVISORY
• CONFIRM
• CONFIRM
• DEBIAN
• FEDORA
• FEDORA
• FEDORA
• GENTOO
• MLIST

Overview

nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab).

References

• Debian Security Tracker
• MISC
• MISC
• MLIST
• SUSE
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC

Overview

A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).

References

• Debian Security Tracker
• GENTOO
• MLIST
• RedHat Bugzilla Bug
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC

Overview

Affected versions of this package are vulnerable to Integer Overflow or Wraparound. In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC
• MLIST
• UBUNTU

Overview

libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of the allocated data of an ExifMnote entry which can cause denial-of-service or possibly information disclosure.

References

• CVE Details
• Debian Security Tracker
• MISC
• MLIST
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read. An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• Debian Security Announcement
• Debian Security Tracker
• GENTOO
• GitHub Commit
• SUSE
• UBUNTU

Overview

In libexif, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege in the media content provider with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112537774

References

• BUGTRAQ
• CONFIRM
• CONFIRM
• DEBIAN
• Debian Security Tracker
• FEDORA
• FEDORA
• GENTOO
• MISC
• MLIST
• MLIST
• OSS security Advisory
• OSS security Advisory
• SUSE
• SUSE
• UBUNTU
• Ubuntu CVE Tracker

Overview

An error when processing the EXIF_IFD_INTEROPERABILITY and EXIF_IFD_EXIF tags within libexif version 0.6.21 can be exploited to exhaust available CPU resources.

References

• Debian Security Announcement
• Debian Security Tracker
• GitHub Commit
• MISC
• MLIST
• OpenSuse Security Announcement
• SUSE
• Ubuntu CVE Tracker
• Ubuntu Security Advisory

Overview

Affected versions of this package are vulnerable to Resource Exhaustion. An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• Debian Security Announcement
• Debian Security Tracker
• GENTOO
• GitHub Commit
• SUSE
• UBUNTU

Overview

Affected versions of this package are vulnerable to Use After Free. An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.

Remediation

Upgrade libexif to version or higher.

References

• ADVISORY
• Debian Security Announcement
• Debian Security Tracker
• GENTOO
• GitHub Commit
• SUSE
• UBUNTU

Overview

Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation.

References

• Debian Security Tracker
• GitHub Issue
• OSS security Advisory
• OpenSuse Security Update
• OpenSuse Security Update
• Security Focus
• Ubuntu CVE Tracker

Overview

** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'"

References

• Debian Security Tracker
• GitHub Issue

Overview

Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

References

• CONFIRM
• CONFIRM
• Debian Security Advisory
• Debian Security Announcement
• Debian Security Tracker
• Ubuntu CVE Tracker

Overview

Affected versions of this package are vulnerable to Out-of-bounds Read libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.

Remediation

Upgrade libjpeg-turbo to version or higher.

References

• ADVISORY
• ADVISORY
• FEDORA
• FEDORA
• GENTOO
• MISC
• MISC
• MLIST
• SUSE
• SUSE
• UBUNTU