libjpeg-turbo: User-assisted execution of arbitrary code — GLSA 201612-55

An out-of-bounds read in libjpeg-turbo might allow remote attackers to execute arbitrary code.

Affected packages

Background

libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression.

Description

The accelerated Huffman decoder was previously invoked if there were 128 bytes in the input buffer. However, it is possible to construct a JPEG image with Huffman blocks > 430 bytes in length. This release simply increases the minimum buffer size for the accelerated Huffman decoder to 512 bytes, which should accommodate any possible input.

Impact

A remote attacker could coerce the victim to run a specially crafted image file resulting in the execution of arbitrary code.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=media-libs/libjpeg-turbo-1.5.0"
 

References

• LJT-01-005
• Prevent overread when decoding malformed JPEG

Release date
December 31, 2016

Latest revision
December 31, 2016: 1

Severity
normal

Exploitable
remote

Bugzilla entries

• 585782