Skip to content
OpenAdvisories
High ALAS2-2023-2254 2 CVEs

Important: libjpeg-turbo security update (Amazon Linux 2)

Published Sep 13, 2023 · Updated Oct 30, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-29390: libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c. CVE-2020-17541: Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 libjpeg-turbo 0:2.0.90-2.amzn2.0.6
Amazon Linux · 2 libjpeg-turbo-debuginfo 0:2.0.90-2.amzn2.0.6
Amazon Linux · 2 libjpeg-turbo-devel 0:2.0.90-2.amzn2.0.6
Amazon Linux · 2 libjpeg-turbo-utils 0:2.0.90-2.amzn2.0.6
Amazon Linux · 2 turbojpeg 0:2.0.90-2.amzn2.0.6
Amazon Linux · 2 turbojpeg-devel 0:2.0.90-2.amzn2.0.6

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-17541.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29390.html