[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1VjT65-00040d-FO@titan.mandriva.com>
Date: Thu, 21 Nov 2013 13:11:01 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2013:273 ] libjpeg
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:273
http://www.mandriva.com/en/support/security/
_______________________________________________________________________
Package : libjpeg
Date : November 21, 2013
Affected: Business Server 1.0
_______________________________________________________________________
Problem Description:
Updated libjpeg packages fix security vulnerabilities:
libjpeg 6b and libjpeg-turbo will use uninitialized memory when
decoding images with missing SOS data for the luminance component
(Y) in presence of valid chroma data (Cr, Cb) (CVE-2013-6629).
libjpeg-turbo will use uninitialized memory when handling Huffman
tables (CVE-2013-6630).
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6630
http://advisories.mageia.org/MGASA-2013-0333.html
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
4b3246c5236cce36539c5a3f3383e141 mbs1/x86_64/jpeg-progs-1.2.0-5.2.mbs1.x86_64.rpm
e903e2d84d5975c84feb30bf61e9fc27 mbs1/x86_64/lib64jpeg62-1.2.0-5.2.mbs1.x86_64.rpm
ed2b02157825d772109fd321a4bd8da5 mbs1/x86_64/lib64jpeg8-1.2.0-5.2.mbs1.x86_64.rpm
6257733e093dc32b01a6e9fe695f75c5 mbs1/x86_64/lib64jpeg-devel-1.2.0-5.2.mbs1.x86_64.rpm
f5880a061f6ffe706c92619516cdb483 mbs1/x86_64/lib64jpeg-static-devel-1.2.0-5.2.mbs1.x86_64.rpm
e9d23e700d88863fa51623fa318e9203 mbs1/SRPMS/libjpeg-1.2.0-5.2.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFSjc42mqjQ0CJFipgRAjjdAKCyA6j70X2L2kyFbcb+Lf9DfvdGzQCgjN3I
zZpqCNbcAEXpDneYn4hAA/o=
=5rwB
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists