Integer overflow in libjpeg-turbo - CVE-2019-2201

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU22854

Integer overflow in libjpeg-turbo - CVE-2019-2201

Published: November 19, 2019


Vulnerability identifier: #VU22854
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-2201
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in tjbench.c when handling JPEG images. A remote attacker can create a specially crafted JPEG image, pass it to the affected application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

libjpeg-turbo
Gentoo Linux
Opensuse
Fedora
libjpeg-turbo (Alpine package)
libjpeg-turbo (Ubuntu package)
libjpeg-turbo
IBM Tivoli Storage Manager
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

How to mitigate CVE-2019-2201

Install updates from vendor's website.

libjpeg-turbo - update to 2.0.3
libjpeg-turbo (Alpine package) - update to 1.5.3-r6
libjpeg-turbo (Ubuntu package) - addressed in versions 1.4.2-0ubuntu3.3, 1.5.2-0ubuntu5.18.04.3, 2.0.1-0ubuntu2.2
libjpeg-turbo - update to 2.0.2-5.fc31
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014

External References

Related Security Bulletins