Bug 2122387 (CVE-2020-35538)

Summary:	CVE-2020-35538 libjpeg-turbo: Null pointer dereference in jcopy_sample_rows() function
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	adudiak, caswilli, dffrench, erik-fedora, fjansen, gzaronik, jburrell, jkoehler, jwong, kaycoth, klember, kshier, manisandro, mmuzila, negativo17, nforro, ngough, phracek, rgodfrey, rh-spice-bugs, rjones, sthirugn, vkrizan, vonsch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libjpeg-turbo 2.0.6	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in libjpeg-turbo where a segmentation fault occurs due to a NULL pointer passing to jcopy_sample_rows(). You may see this error statement: "Corrupt JPEG data: premature end of data segment". When processed by a libjpeg-turbo, a crafted input file could cause a crash, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	2128955, 2128956, 2134056, 2134057, 2134058
Bug Blocks:	2122389

Description Pedro Sampaio 2022-08-29 22:23:38 UTC

A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.

Upstream issue:

https://github.com/libjpeg-turbo/libjpeg-turbo/issues/441

Upstream fix:

https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30

Comment 2 TEJ RATHI 2022-09-22 05:37:48 UTC

Created libjpeg-turbo tracking bugs for this issue:

Affects: fedora-all [bug 2128955]


Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: fedora-all [bug 2128956]