Synopsis

Moderate: libjpeg-turbo security update

Type/Severity

Security Advisory: Moderate

Topic

An update for libjpeg-turbo is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.

Security Fix(es):

• libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

• BZ - 1687424 - CVE-2018-14498 libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service
• BZ - 1688397 - libjpeg-turbo: Support running with Intel CET

CVEs

• CVE-2018-14498

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/

Red Hat Enterprise Linux for x86_64 8

SRPM
libjpeg-turbo-1.5.3-10.el8.src.rpm	SHA-256: 22f88b891803b1c435ac144b81350a3cd3ce7204a140860d1ae89ce8e187d5e4
x86_64
libjpeg-turbo-1.5.3-10.el8.i686.rpm	SHA-256: 75e86b89f0346099c81b41c6c5d244dd4680954fc40b26edee9784bc452acb3c
libjpeg-turbo-1.5.3-10.el8.x86_64.rpm	SHA-256: 80aef33a78a94323dd92efb71ce39817b8b88d75629a3f42089f886caac7f474
libjpeg-turbo-debuginfo-1.5.3-10.el8.i686.rpm	SHA-256: 1fad8e0ef74c7c035d43d42a496a686732f5e8ae3e7a1df63c3aee1d6ec07ea6
libjpeg-turbo-debuginfo-1.5.3-10.el8.x86_64.rpm	SHA-256: 2656e7e9013d85fe055206afc88a6c6366c46170bc68f90736b53ea600f7086d
libjpeg-turbo-debugsource-1.5.3-10.el8.i686.rpm	SHA-256: a8828a5c8ff048392e1113b311ac2455e8b60818f304b3f758c859a24504361d
libjpeg-turbo-debugsource-1.5.3-10.el8.x86_64.rpm	SHA-256: 6b9d1c3681e5b789a1a22ddff0f476f7b1561cc99a6934e5f71b419891fdcc59
libjpeg-turbo-devel-1.5.3-10.el8.i686.rpm	SHA-256: 19106749159d8314d513c5cd6d9cc28d040104216c1efb6fb8e14ed17c41a6f3
libjpeg-turbo-devel-1.5.3-10.el8.x86_64.rpm	SHA-256: 851f6924e9d222e60f9e60378d1cd92848f064fdae8799cad83d7af7ff3a1a1a
libjpeg-turbo-utils-1.5.3-10.el8.x86_64.rpm	SHA-256: 2347c85133cea0bad52ba16421989aa836715a2d8d7e506669e5b867bea1b67a
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.i686.rpm	SHA-256: 9c8dd600ac0a2e46ecfb3f245ac04f97f4cf526493c8a655dc55afab86c7601d
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.x86_64.rpm	SHA-256: 234dc72409b4fe03dc9f6ee9cf5d57b4120a142b2e16689c89ce36c8bb82cd1b
turbojpeg-1.5.3-10.el8.i686.rpm	SHA-256: 9f2bfeb01196d97491c9057140493334b1ae6f71830bbddf472e6ff378138b3a
turbojpeg-1.5.3-10.el8.x86_64.rpm	SHA-256: 7a414f0b3541410224d769398bce76e58d35f8312b01e0a392eece0d83e0441f
turbojpeg-debuginfo-1.5.3-10.el8.i686.rpm	SHA-256: b10557a36fd950a317017e6abbcb892b2591e5194b8c2d343905df82788d08bb
turbojpeg-debuginfo-1.5.3-10.el8.x86_64.rpm	SHA-256: 4de0250f23be8721361df93f4a16e3942fe76c92a241ef98b042bd018391252f

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libjpeg-turbo-1.5.3-10.el8.src.rpm	SHA-256: 22f88b891803b1c435ac144b81350a3cd3ce7204a140860d1ae89ce8e187d5e4
s390x
libjpeg-turbo-1.5.3-10.el8.s390x.rpm	SHA-256: 955479f1e6f88a3196b92668466744a74c2419c1bb5c4322051a26e3c3c7dcf0
libjpeg-turbo-debuginfo-1.5.3-10.el8.s390x.rpm	SHA-256: f4611f21ee963a95062c49f1d9f5c6052121c3ff1975bbf658f2f34731795a0e
libjpeg-turbo-debugsource-1.5.3-10.el8.s390x.rpm	SHA-256: 576d2f047bfae07779a193fbabf6d23510202c645d3efda482360d48fce506b9
libjpeg-turbo-devel-1.5.3-10.el8.s390x.rpm	SHA-256: 4d8454b13b422d9a007dc312d38c657f3b759500d1cfc98379e0c99dc89bd50c
libjpeg-turbo-utils-1.5.3-10.el8.s390x.rpm	SHA-256: 00dc64f79a418966cf0441c0e7a2aa0edd238931c928a33b87944e326c77d83f
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.s390x.rpm	SHA-256: ec363d406e5d2350f29b72118ddd34716b75a9fa4fce91cabc2f21a6ed25c8d2
turbojpeg-1.5.3-10.el8.s390x.rpm	SHA-256: a4b743dbe191dab1307dffc3095691af50aa8a9c826865c39c20979247a5c72a
turbojpeg-debuginfo-1.5.3-10.el8.s390x.rpm	SHA-256: d13ecba1488a441a840f0c3589fa5844507f5a5cf4b8d578daf079abf8660a21

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libjpeg-turbo-1.5.3-10.el8.src.rpm	SHA-256: 22f88b891803b1c435ac144b81350a3cd3ce7204a140860d1ae89ce8e187d5e4
ppc64le
libjpeg-turbo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 920c261816d00f97f55e737f282ea1aa4d3c44e7018cf5e5d5eb6b1a0e6bc14f
libjpeg-turbo-debuginfo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 6f9a0741ce1a09a383b51b5c53c91f5e58c38bb7debfc3aa8bbf78579bd74d1b
libjpeg-turbo-debugsource-1.5.3-10.el8.ppc64le.rpm	SHA-256: 2579da4e024225e27637a116d5359aafa600d9d37467448835f013a07d6ccbd9
libjpeg-turbo-devel-1.5.3-10.el8.ppc64le.rpm	SHA-256: 546a04b20b79f72c12c787f4e90b0ffb9250eabb19836b658c5ec6c83b23c726
libjpeg-turbo-utils-1.5.3-10.el8.ppc64le.rpm	SHA-256: 2e15e070af34d90fbef3fd9008ffa5c242f3ffc5ee46ae9be0d9335f876f8bc0
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 21ad9e4d8bf76a557b47a8782279ac2957e3f36d5d6dac34cd78dac943a6d31f
turbojpeg-1.5.3-10.el8.ppc64le.rpm	SHA-256: bb80951b7702f43a83192c3f9d21ad7a07d43cda39e3f9eabc6be076461e52c1
turbojpeg-debuginfo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 3233e5d8159c2cf792d002d31f1b0c49e4b7666145d3c26cecc1aa8786354e95

Red Hat Enterprise Linux for ARM 64 8

SRPM
libjpeg-turbo-1.5.3-10.el8.src.rpm	SHA-256: 22f88b891803b1c435ac144b81350a3cd3ce7204a140860d1ae89ce8e187d5e4
aarch64
libjpeg-turbo-1.5.3-10.el8.aarch64.rpm	SHA-256: 69d6d9ef754b984bbfe790548bff37fe411cb79820f3078e80203eec92053ae4
libjpeg-turbo-debuginfo-1.5.3-10.el8.aarch64.rpm	SHA-256: 344cf2c66424123ab818c7caf64fdad54bf3dcfe2797dc883912ed83e7c5be59
libjpeg-turbo-debugsource-1.5.3-10.el8.aarch64.rpm	SHA-256: b15dbcf6328311fadef266ca559dd8b8e701fd04e6080c5b5be748437b419574
libjpeg-turbo-devel-1.5.3-10.el8.aarch64.rpm	SHA-256: 12edbe24053731f3c24d9b63d7e1c00dc126f3882b1ec7a95ac50c1a9f0835fe
libjpeg-turbo-utils-1.5.3-10.el8.aarch64.rpm	SHA-256: 6545b8a6ad028481b02dcabb429fcdd9db5219943b49cd770a06725dfeaa5065
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.aarch64.rpm	SHA-256: d4e6b6d78bd21ad4d29e598b2e97b722190b39458a8f7af5e67d6fda3b765e83
turbojpeg-1.5.3-10.el8.aarch64.rpm	SHA-256: 471cfbe218ada1b611e25dcb12d8964a48039db59fc7157e4ddfcb683da0fa96
turbojpeg-debuginfo-1.5.3-10.el8.aarch64.rpm	SHA-256: ba9dad3724e4c26890477fb3ecdb39fe413a28df900ae55b9a29f72db2e3e207

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
libjpeg-turbo-debuginfo-1.5.3-10.el8.i686.rpm	SHA-256: 1fad8e0ef74c7c035d43d42a496a686732f5e8ae3e7a1df63c3aee1d6ec07ea6
libjpeg-turbo-debuginfo-1.5.3-10.el8.x86_64.rpm	SHA-256: 2656e7e9013d85fe055206afc88a6c6366c46170bc68f90736b53ea600f7086d
libjpeg-turbo-debugsource-1.5.3-10.el8.i686.rpm	SHA-256: a8828a5c8ff048392e1113b311ac2455e8b60818f304b3f758c859a24504361d
libjpeg-turbo-debugsource-1.5.3-10.el8.x86_64.rpm	SHA-256: 6b9d1c3681e5b789a1a22ddff0f476f7b1561cc99a6934e5f71b419891fdcc59
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.i686.rpm	SHA-256: 9c8dd600ac0a2e46ecfb3f245ac04f97f4cf526493c8a655dc55afab86c7601d
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.x86_64.rpm	SHA-256: 234dc72409b4fe03dc9f6ee9cf5d57b4120a142b2e16689c89ce36c8bb82cd1b
turbojpeg-debuginfo-1.5.3-10.el8.i686.rpm	SHA-256: b10557a36fd950a317017e6abbcb892b2591e5194b8c2d343905df82788d08bb
turbojpeg-debuginfo-1.5.3-10.el8.x86_64.rpm	SHA-256: 4de0250f23be8721361df93f4a16e3942fe76c92a241ef98b042bd018391252f
turbojpeg-devel-1.5.3-10.el8.i686.rpm	SHA-256: dde55a45c4532f61a1c432b0918482aead7fc5ef0dcb050bc419a471613ce47d
turbojpeg-devel-1.5.3-10.el8.x86_64.rpm	SHA-256: 457c85ed6ea9b1b2eda1c484a9457c90cd7c78c47d4974b8d672ebfdcc9a884a

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
libjpeg-turbo-debuginfo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 6f9a0741ce1a09a383b51b5c53c91f5e58c38bb7debfc3aa8bbf78579bd74d1b
libjpeg-turbo-debugsource-1.5.3-10.el8.ppc64le.rpm	SHA-256: 2579da4e024225e27637a116d5359aafa600d9d37467448835f013a07d6ccbd9
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 21ad9e4d8bf76a557b47a8782279ac2957e3f36d5d6dac34cd78dac943a6d31f
turbojpeg-debuginfo-1.5.3-10.el8.ppc64le.rpm	SHA-256: 3233e5d8159c2cf792d002d31f1b0c49e4b7666145d3c26cecc1aa8786354e95
turbojpeg-devel-1.5.3-10.el8.ppc64le.rpm	SHA-256: fb1df926864f91d71749b06211745e2e941827982319af387b1bdc7b8af44d61

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
libjpeg-turbo-debuginfo-1.5.3-10.el8.aarch64.rpm	SHA-256: 344cf2c66424123ab818c7caf64fdad54bf3dcfe2797dc883912ed83e7c5be59
libjpeg-turbo-debugsource-1.5.3-10.el8.aarch64.rpm	SHA-256: b15dbcf6328311fadef266ca559dd8b8e701fd04e6080c5b5be748437b419574
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.aarch64.rpm	SHA-256: d4e6b6d78bd21ad4d29e598b2e97b722190b39458a8f7af5e67d6fda3b765e83
turbojpeg-debuginfo-1.5.3-10.el8.aarch64.rpm	SHA-256: ba9dad3724e4c26890477fb3ecdb39fe413a28df900ae55b9a29f72db2e3e207
turbojpeg-devel-1.5.3-10.el8.aarch64.rpm	SHA-256: 4c645e7503687a2cadd44988a6acfcb40cbafbc1e0c873a4e87cbef5c84e1ff7

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
libjpeg-turbo-debuginfo-1.5.3-10.el8.s390x.rpm	SHA-256: f4611f21ee963a95062c49f1d9f5c6052121c3ff1975bbf658f2f34731795a0e
libjpeg-turbo-debugsource-1.5.3-10.el8.s390x.rpm	SHA-256: 576d2f047bfae07779a193fbabf6d23510202c645d3efda482360d48fce506b9
libjpeg-turbo-utils-debuginfo-1.5.3-10.el8.s390x.rpm	SHA-256: ec363d406e5d2350f29b72118ddd34716b75a9fa4fce91cabc2f21a6ed25c8d2
turbojpeg-debuginfo-1.5.3-10.el8.s390x.rpm	SHA-256: d13ecba1488a441a840f0c3589fa5844507f5a5cf4b8d578daf079abf8660a21
turbojpeg-devel-1.5.3-10.el8.s390x.rpm	SHA-256: 2ef55fbeccbdacac1a694d3d60ab3cfa95627f22d25accafa19632d2486bb34c