Bug 1968036 (CVE-2020-17541)
Summary: | CVE-2020-17541 libjpeg-turbo: Stack-based buffer overflow in the "transform" component | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED NOTABUG | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | erik-fedora, fcanogab, gkamathe, kaycoth, klember, manisandro, micjohns, negativo17, nforro, phracek, pwayper, rh-spice-bugs, rjones, vmugicag, vonsch |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | libjpeg-turbo 2.0.4 | Doc Type: | If docs needed, set a value |
Doc Text: |
A stack-based buffer overflow flaw was found in libjpeg-turbo library in the tranform component. An attacker may use this flaw to input a malicious image file to an application utilizing this library, leading to arbitrary code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-07-21 03:26:36 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1973139, 1973141, 1968037, 1968038, 1972289, 1972290, 1973137, 1973138, 1973140, 1973142, 1973143 | ||
Bug Blocks: | 1968039 |
Description
Pedro Sampaio
2021-06-04 18:39:54 UTC
Created libjpeg-turbo tracking bugs for this issue: Affects: fedora-all [bug 1968037] Created mingw-libjpeg-turbo tracking bugs for this issue: Affects: fedora-all [bug 1968038] Upstream patch: https://github.com/libjpeg-turbo/libjpeg-turbo/commit/c76f4a08263b0cea40d2967560ac7c21f6959079 @fcanogab Since the package closed the issue, even though it has been fixed, do we still need to track this bug. Should we close? This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4288 https://access.redhat.com/errata/RHSA-2021:4288 |