Source: libjpeg X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security
Hi, The following vulnerabilities were published for libjpeg. CVE-2023-37836[0]: | libjpeg commit db33a6e was discovered to contain a reachable | assertion via BitMapHook::BitMapHook at bitmaphook.cpp. This | vulnerability allows attackers to cause a Denial of Service (DoS) | via a crafted file. https://github.com/thorfdbg/libjpeg/issues/87#BUG1 Fixed by: https://github.com/thorfdbg/libjpeg/commit/9e0cea29d7ba7a2c1e763865391bc94b336da25e CVE-2023-37837[1]: | libjpeg commit db33a6e was discovered to contain a heap buffer | overflow via LineBitmapRequester::EncodeRegion at | linebitmaprequester.cpp. This vulnerability allows attackers to | cause a Denial of Service (DoS) via a crafted file. https://github.com/thorfdbg/libjpeg/issues/87#BUG0 Fixed by: https://github.com/thorfdbg/libjpeg/commit/9e0cea29d7ba7a2c1e763865391bc94b336da25e If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-37836 https://www.cve.org/CVERecord?id=CVE-2023-37836 [1] https://security-tracker.debian.org/tracker/CVE-2023-37837 https://www.cve.org/CVERecord?id=CVE-2023-37837 Please adjust the affected versions in the BTS as needed.
