A vulnerability was found in libjpeg-turbo, where a fixed out-of-bounds write in tjDecompressToYUV2() and tjDecompressToYUVPlanes() (sometimes manifesting as a double free) that occurred when attempting to decompress grayscale JPEG images that were compressed with a sampling factor other than 1.
Created libjpeg-turbo tracking bugs for this issue:
Affects: fedora-all [bug 1850485]
This is same as CVE-2019-2201
*** This bug has been marked as a duplicate of bug 1770982 ***
Upstream bug: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/387
Upstream commit at: https://github.com/libjpeg-turbo/libjpeg-turbo/commit/dab6be4cfb2f9307b5378d2d1dc74d9080383dc2