Heap-based buffer overflow in the get_sos function in jdmarker.c in libjpeg-turbo 1.2.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large component count in the header of a JPEG image.

- fixed heap overflow [bnc#771791]

  - CVE-2012-2806.patch

A vulnerability has been discovered and corrected in libjpeg :

A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially crafted JPEG image that, when opened, could cause an application using libpng to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2012-2806).

The updated packages have been patched to correct this issue.

This update to libjpeg fixes a heap overflow in the JPEG decompression functions. (CVE-2012-2806)

The remote host is affected by the vulnerability described in GLSA-201209-13 (libjpeg-turbo: User-assisted execution of arbitrary code)

    A vulnerability in the get_sos() function in jdmarker.c could cause a       heap-based buffer overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted JPEG       file in an application linked against libjpeg-turbo, possibly resulting       in the remote execution of arbitrary code with the permissions of the       user running the application, or Denial of Service.
  Workaround :

    There is no known workaround at this time.

A vulnerability has been discovered and corrected in libjpeg-turbo :

A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially crafted JPEG image that, when opened, could cause an application using libpng to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2012-2806).

The updated packages have been patched to correct this issue.

Update to the 1.2.1 bugfix release. For detailed list of changes check /usr/share/doc/libjpeg-turbo/ChangeLog.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Changelog for version 1.2.1 says: Fixed a regression caused by 1.2.0[6] in which decompressing corrupt JPEG images (specifically, images in which the component count was erroneously set to a large value) would cause libjpeg-turbo to segfault.

A Heap-based buffer overflow was found in the way libjpeg-turbo decompressed certain corrupt JPEG images in which the component count was erroneously set to a large value. An attacker could create a specially crafted JPEG image that, when opened, could cause an application using libpng to crash or, possibly, execute arbitrary code with the privileges of the user running the application.

ID	Name	Product	Family	Severity
74694	openSUSE Security Update : libjpeg-turbo (openSUSE-SU-2012:0932-1)	Nessus	SuSE Local Security Checks	medium
66058	Mandriva Linux Security Advisory : libjpeg (MDVSA-2013:044)	Nessus	Mandriva Local Security Checks	medium
64172	SuSE 11.1 Security Update : libjpeg (SAT Patch Number 6586)	Nessus	SuSE Local Security Checks	medium
62342	GLSA-201209-13 : libjpeg-turbo: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
61971	Mandriva Linux Security Advisory : libjpeg-turbo (MDVSA-2012:121)	Nessus	Mandriva Local Security Checks	medium
61567	SuSE 10 Security Update : libjpeg (ZYPP Patch Number 8233)	Nessus	SuSE Local Security Checks	medium
61465	Fedora 16 : libjpeg-turbo-1.2.1-1.fc16 (2012-10721)	Nessus	Fedora Local Security Checks	medium
60056	FreeBSD : libjpeg-turbo -- heap-based buffer overflow (a460035e-d111-11e1-aff7-001fd056c417)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-2806

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium