Security update for libjpeg-turbo SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:2899-1 Final 1 1 2017-10-28T14:00:40Z current 2017-10-28T14:00:40Z 2017-10-28T14:00:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libjpeg-turbo This update for libjpeg-turbo to version 1.5.2 fixes the following issues: * CVE-2017-15232: NULL pointer dereference in jdpostct.c and jquant1.c (boo#1062937) This compatible version update contains the following improvements: * Improved and updated upsampling support and sampling factors * Memory handling correctness fixes * Improved robustness when decoding images This version is a dependency of Chromium 62. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-10/msg00115.html E-Mail link for openSUSE-SU-2017:2899-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 openSUSE Leap 42.3 libjpeg-turbo-1.5.2-38.1 libjpeg62-62.2.0-38.1 libjpeg62-32bit-62.2.0-38.1 libjpeg62-devel-62.2.0-38.1 libjpeg62-devel-32bit-62.2.0-38.1 libjpeg62-turbo-1.5.2-38.1 libjpeg8-8.1.2-38.1 libjpeg8-32bit-8.1.2-38.1 libjpeg8-devel-8.1.2-38.1 libjpeg8-devel-32bit-8.1.2-38.1 libturbojpeg0-8.1.2-38.1 libturbojpeg0-32bit-8.1.2-38.1 libjpeg-turbo-1.5.2-38.1 as a component of openSUSE Leap 42.2 libjpeg62-62.2.0-38.1 as a component of openSUSE Leap 42.2 libjpeg62-32bit-62.2.0-38.1 as a component of openSUSE Leap 42.2 libjpeg62-devel-62.2.0-38.1 as a component of openSUSE Leap 42.2 libjpeg62-devel-32bit-62.2.0-38.1 as a component of openSUSE Leap 42.2 libjpeg62-turbo-1.5.2-38.1 as a component of openSUSE Leap 42.2 libjpeg8-8.1.2-38.1 as a component of openSUSE Leap 42.2 libjpeg8-32bit-8.1.2-38.1 as a component of openSUSE Leap 42.2 libjpeg8-devel-8.1.2-38.1 as a component of openSUSE Leap 42.2 libjpeg8-devel-32bit-8.1.2-38.1 as a component of openSUSE Leap 42.2 libturbojpeg0-8.1.2-38.1 as a component of openSUSE Leap 42.2 libturbojpeg0-32bit-8.1.2-38.1 as a component of openSUSE Leap 42.2 libjpeg-turbo-1.5.2-38.1 as a component of openSUSE Leap 42.3 libjpeg62-62.2.0-38.1 as a component of openSUSE Leap 42.3 libjpeg62-32bit-62.2.0-38.1 as a component of openSUSE Leap 42.3 libjpeg62-devel-62.2.0-38.1 as a component of openSUSE Leap 42.3 libjpeg62-devel-32bit-62.2.0-38.1 as a component of openSUSE Leap 42.3 libjpeg62-turbo-1.5.2-38.1 as a component of openSUSE Leap 42.3 libjpeg8-8.1.2-38.1 as a component of openSUSE Leap 42.3 libjpeg8-32bit-8.1.2-38.1 as a component of openSUSE Leap 42.3 libjpeg8-devel-8.1.2-38.1 as a component of openSUSE Leap 42.3 libjpeg8-devel-32bit-8.1.2-38.1 as a component of openSUSE Leap 42.3 libturbojpeg0-8.1.2-38.1 as a component of openSUSE Leap 42.3 libturbojpeg0-32bit-8.1.2-38.1 as a component of openSUSE Leap 42.3 libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file. CVE-2017-15232 openSUSE Leap 42.2:libjpeg-turbo-1.5.2-38.1 openSUSE Leap 42.2:libjpeg62-32bit-62.2.0-38.1 openSUSE Leap 42.2:libjpeg62-62.2.0-38.1 openSUSE Leap 42.2:libjpeg62-devel-32bit-62.2.0-38.1 openSUSE Leap 42.2:libjpeg62-devel-62.2.0-38.1 openSUSE Leap 42.2:libjpeg62-turbo-1.5.2-38.1 openSUSE Leap 42.2:libjpeg8-32bit-8.1.2-38.1 openSUSE Leap 42.2:libjpeg8-8.1.2-38.1 openSUSE Leap 42.2:libjpeg8-devel-32bit-8.1.2-38.1 openSUSE Leap 42.2:libjpeg8-devel-8.1.2-38.1 openSUSE Leap 42.2:libturbojpeg0-32bit-8.1.2-38.1 openSUSE Leap 42.2:libturbojpeg0-8.1.2-38.1 openSUSE Leap 42.3:libjpeg-turbo-1.5.2-38.1 openSUSE Leap 42.3:libjpeg62-32bit-62.2.0-38.1 openSUSE Leap 42.3:libjpeg62-62.2.0-38.1 openSUSE Leap 42.3:libjpeg62-devel-32bit-62.2.0-38.1 openSUSE Leap 42.3:libjpeg62-devel-62.2.0-38.1 openSUSE Leap 42.3:libjpeg62-turbo-1.5.2-38.1 openSUSE Leap 42.3:libjpeg8-32bit-8.1.2-38.1 openSUSE Leap 42.3:libjpeg8-8.1.2-38.1 openSUSE Leap 42.3:libjpeg8-devel-32bit-8.1.2-38.1 openSUSE Leap 42.3:libjpeg8-devel-8.1.2-38.1 openSUSE Leap 42.3:libturbojpeg0-32bit-8.1.2-38.1 openSUSE Leap 42.3:libturbojpeg0-8.1.2-38.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-10/msg00115.html https://www.suse.com/security/cve/CVE-2017-15232.html CVE-2017-15232 https://bugzilla.suse.com/1062937 SUSE Bug 1062937 https://bugzilla.suse.com/1149960 SUSE Bug 1149960