Thanks for the report. I'm marking this one "invalid" because libjpeg8 appears to exist only to suggest using libjpeg-turbo:
$ umt search libjpeg8 Running search command. Ubuntu packages: Other packages: squeeze: 8b-1, Pocket: release, Component: main unstable: 8d-1, Pocket: release, Component: main wheezy: 8d-1, Pocket: release, Component: main $ apt-cache show libjpeg8 Package: libjpeg8 Priority: optional Section: libs Installed-Size: 26 Maintainer: Ubuntu Developers <ubuntu-devel-disc...@lists.ubuntu.com> Architecture: amd64 Source: libjpeg8-empty Version: 8c-2ubuntu8 Depends: libjpeg-turbo8 (>= 1.1.90+svn722-1ubuntu6) ... $ apt-cache show libjpeg-turbo8 Package: libjpeg-turbo8 Priority: optional Section: libs Installed-Size: 330 Maintainer: Ubuntu Developers <ubuntu-devel-disc...@lists.ubuntu.com> Architecture: amd64 Source: libjpeg-turbo Version: 1.3.0-0ubuntu1 Replaces: libjpeg8 (<< 8c-2ubuntu5) ... If I've missed something, please let me know, but I think libjpeg6b and libjpeg-turbo are the only source packages we need to worry about. Thanks ** Changed in: libjpeg8 (Ubuntu) Status: New => Invalid ** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1252913 Title: CVE-2013-6629 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libjpeg8/+bug/1252913/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs