libjpeg-turbo: Multiple vulnerabilities

2016-06-05T00:00:00
ID GLSA-201606-03
Type gentoo
Reporter Gentoo Foundation
Modified 2016-06-05T00:00:00

Description

Background

libjpeg-turbo is a MMX, SSE, and SSE2 SIMD accelerated JPEG library

Description

libjpeg-turbo does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers.

Impact

Remote attackers could obtain sensitive information from uninitialized memory locations via a crafted JPEG images.

Workaround

There is no known workaround at this time.

Resolution

All libjpeg-turbo users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.4.2"