Stack-based buffer overflow in libjpeg-turbo - CVE-2020-17541

Vulnerability identifier: #VU54089

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-17541

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the in the "transform" component in Libjpeg-turb. A remote attacker can create a specially crafted JPEG image, pass it to the affected aplication, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libjpeg-turbo
Gentoo Linux
SUSE MicroOS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Packagehub Subpackages
libjpeg-turbo-test (Ubuntu package)
libjpeg-turbo8 (Ubuntu package)
libjpeg-turbo-progs (Ubuntu package)
libturbojpeg (Ubuntu package)
libjpeg-turbo-debugsource
libjpeg-turbo-debuginfo
libjpeg-turbo
libjpeg-turbo (Red Hat package)
libjpeg62-turbo
libjpeg62-turbo-debugsource
media-libs/libjpeg-turbo
libjpeg8-debuginfo
libjpeg8
libjpeg8-32bit
libjpeg8-32bit-debuginfo
libjpeg8-devel
libturbojpeg0
libturbojpeg0-debuginfo
libjpeg8-debuginfo-32bit
libjpeg62-devel
libjpeg62-debuginfo
libjpeg62
libjpeg62-debuginfo-32bit
libjpeg62-32bit
Tanzu Greenplum for Kubernetes
VMware Tanzu Operations Manager
OpenShift Virtualization
Red Hat OpenShift Container Platform
Dell EMC VxRail Appliance

Install updates from vendor's website.

libjpeg-turbo - update to 2.0.4
libjpeg-turbo-test (Ubuntu package) - update to 1.4.20ubuntu3.4+esm1
libjpeg-turbo8 (Ubuntu package) - addressed in versions 1.4.20ubuntu3.4+esm1, 1.5.2-0ubuntu5.18.04.6, 2.0.3-0ubuntu1.20.04.3
libjpeg-turbo-progs (Ubuntu package) - update to 1.4.20ubuntu3.4+esm1
libturbojpeg (Ubuntu package) - addressed in versions 1.4.20ubuntu3.4+esm1, 1.5.2-0ubuntu5.18.04.6, 2.0.3-0ubuntu1.20.04.3
libjpeg-turbo-debugsource - addressed in versions 1.5.3-5.18.1, 1.5.3-31.25.1
libjpeg-turbo-debuginfo - addressed in versions 1.5.3-5.18.1, 1.5.3-31.25.1
libjpeg-turbo - addressed in versions 1.5.3-5.18.1, 1.5.3-31.25.1
libjpeg-turbo (Red Hat package) - update to 1.5.3-12.el8
libjpeg62-turbo - update to 1.5.3-31.25.1
libjpeg62-turbo-debugsource - update to 1.5.3-31.25.1
Tanzu Greenplum for Kubernetes - update to 2.0.0
media-libs/libjpeg-turbo - update to 2.1.1
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.39
OpenShift Virtualization - update to 4.11.0
Red Hat OpenShift Container Platform - update to 4.11.0
Dell EMC VxRail Appliance - update to 7.0.203
libjpeg8-debuginfo - addressed in versions 8.1.2-5.18.1, 8.1.2-31.25.1
libjpeg8 - addressed in versions 8.1.2-5.18.1, 8.1.2-31.25.1
libjpeg8-32bit - addressed in versions 8.1.2-5.18.1, 8.1.2-31.25.1
libjpeg8-32bit-debuginfo - update to 8.1.2-5.18.1
libjpeg8-devel - addressed in versions 8.1.2-5.18.1, 8.1.2-31.25.1
libturbojpeg0 - addressed in versions 8.1.2-5.18.1, 8.1.2-31.25.1
libturbojpeg0-debuginfo - addressed in versions 8.1.2-5.18.1, 8.1.2-31.25.1
libjpeg8-debuginfo-32bit - update to 8.1.2-31.25.1
libjpeg62-devel - addressed in versions 62.2.0-5.18.1, 62.2.0-31.25.1
libjpeg62-debuginfo - addressed in versions 62.2.0-5.18.1, 62.2.0-31.25.1
libjpeg62 - addressed in versions 62.2.0-5.18.1, 62.2.0-31.25.1
libjpeg62-debuginfo-32bit - update to 62.2.0-31.25.1
libjpeg62-32bit - update to 62.2.0-31.25.1

• https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392
• https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.4

• Multiple vulnerabilities in libjpeg-turbo
• SUSE update for libjpeg-turbo
• SUSE update for libjpeg-turbo
• Ubuntu update for libjpeg-turbo
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in OpenShift Virtualization
• Ubuntu update for libjpeg-turbo
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Red Hat Enterprise Linux 8 update for libjpeg-turbo
• VMware Tanzu products update for libjpeg-turbo
• Gentoo update for libjpeg-turbo