Issued:
2021-11-09
Updated:
2021-11-09

RHSA-2021:4288 - Security Advisory

Synopsis

Moderate: libjpeg-turbo security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libjpeg-turbo is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.

Security Fix(es):

  • libjpeg-turbo: Stack-based buffer overflow in the "transform" component (CVE-2020-17541)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x

Fixes

  • BZ - 1968036 - CVE-2020-17541 libjpeg-turbo: Stack-based buffer overflow in the "transform" component
  • BZ - 1982572 - licence file is missing

Red Hat Enterprise Linux for x86_64 8

SRPM
libjpeg-turbo-1.5.3-12.el8.src.rpm SHA-256: c162dccef3b751d16bc929720db40cfa644b142aed85bb959b6283ea0e095dfc
x86_64
libjpeg-turbo-1.5.3-12.el8.i686.rpm SHA-256: 8df6a33ff503f0300be03a5385a82df64952ef7f6ab2061278f509a78344101b
libjpeg-turbo-1.5.3-12.el8.x86_64.rpm SHA-256: 82dba75523110a451d9f4dbb112c68ba15b1cded1519bc982423de032903dbc9
libjpeg-turbo-debuginfo-1.5.3-12.el8.i686.rpm SHA-256: 3179f8c712f36310d7e3b7c8d99fefb7da109d196323213c782b98a7693ed993
libjpeg-turbo-debuginfo-1.5.3-12.el8.x86_64.rpm SHA-256: b70ddfbe8648fb5e5812b035a4f310918047be5deeda38dfdd55238041b69e9a
libjpeg-turbo-debugsource-1.5.3-12.el8.i686.rpm SHA-256: 920a154ad3682afb66954c61d924e9326e529fc5d3e1a52e1afa00953d365216
libjpeg-turbo-debugsource-1.5.3-12.el8.x86_64.rpm SHA-256: d262910935a691b95f5ac4e03f98e4b750232c7d4521ddae975e41ce391ad9dc
libjpeg-turbo-devel-1.5.3-12.el8.i686.rpm SHA-256: e01ce412dcf04bd767895b770eb37d4115d0d2ecd8d5f7a67242caf20f94fefb
libjpeg-turbo-devel-1.5.3-12.el8.x86_64.rpm SHA-256: a4cb62e94311b184904257d22bbaeabb3e28ed0f5f88038c4e01bcfaff5936cf
libjpeg-turbo-utils-1.5.3-12.el8.x86_64.rpm SHA-256: ef88871db966163f67fe013c381dfb698e68a8328c461c11ea02f5e2fa6fa80d
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.i686.rpm SHA-256: 63a56ec072483f7af9b8acca83c798753f9f4587deaa3990da320fbfc04915d0
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.x86_64.rpm SHA-256: c757d7832212b4a03b3fef3c9b484827ef6dd7f62dd0929fec2d0cf9125f4d39
turbojpeg-1.5.3-12.el8.i686.rpm SHA-256: 19335709f8eb81d5d36738bfb4dcc5b65bafc091f7f48b698159ac792008db3f
turbojpeg-1.5.3-12.el8.x86_64.rpm SHA-256: 8db79107513ba12a79e483ec871a806743a03c4bb377d5d1a5a6cf225b5e05c9
turbojpeg-debuginfo-1.5.3-12.el8.i686.rpm SHA-256: 9b56e4b806191c05f3e3978c0cba7dbf5a411afc9b40917c0162a4786701837c
turbojpeg-debuginfo-1.5.3-12.el8.x86_64.rpm SHA-256: caeef630c4e8abb66fb8469314d2430821edb492fab9718f79f3bd51028802d7

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
libjpeg-turbo-1.5.3-12.el8.src.rpm SHA-256: c162dccef3b751d16bc929720db40cfa644b142aed85bb959b6283ea0e095dfc
s390x
libjpeg-turbo-1.5.3-12.el8.s390x.rpm SHA-256: 8b302180f9d08a505023a79821ee03ffb6973748af46b5b54bb0d05d26cf8b97
libjpeg-turbo-debuginfo-1.5.3-12.el8.s390x.rpm SHA-256: 32dc26601b1675a9bee54855303f6db03e404aa95f9cdfe5b2acef71a13a1b61
libjpeg-turbo-debugsource-1.5.3-12.el8.s390x.rpm SHA-256: c3b9b29a9c3b45949126bf9f3c3a5ac27e7c3e2ddf034da1710afde84eb686b3
libjpeg-turbo-devel-1.5.3-12.el8.s390x.rpm SHA-256: d87da504d6ed0d3f30535f4b06775df0d96ea1ee6107361b031117f38132f768
libjpeg-turbo-utils-1.5.3-12.el8.s390x.rpm SHA-256: ebbcccb392450d54766d7396482c789306e4eaabd5f9014904f9411700c36c36
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.s390x.rpm SHA-256: 72a4e1e5d90f6bc7cf4c60a42e8ed246688a28cb84d2875379f0517b0b8a9926
turbojpeg-1.5.3-12.el8.s390x.rpm SHA-256: a6c998657592a0611177f1315223c2776a9bad5f8ab64c2c900dfd322e3677a7
turbojpeg-debuginfo-1.5.3-12.el8.s390x.rpm SHA-256: 6f59251bc0a160485548ae37f78d426ce7e603e0589c7441c2e6901243732f7b

Red Hat Enterprise Linux for Power, little endian 8

SRPM
libjpeg-turbo-1.5.3-12.el8.src.rpm SHA-256: c162dccef3b751d16bc929720db40cfa644b142aed85bb959b6283ea0e095dfc
ppc64le
libjpeg-turbo-1.5.3-12.el8.ppc64le.rpm SHA-256: dfbeb537e399efa7425fe74cce4b74b7301c578099459a57b2851d3d9345daf1
libjpeg-turbo-debuginfo-1.5.3-12.el8.ppc64le.rpm SHA-256: e799f517a8fcec53cbf68972822f4f70460c0f5d6f4e8015f96719b72df668f3
libjpeg-turbo-debugsource-1.5.3-12.el8.ppc64le.rpm SHA-256: fc4c468d840405d686aa54244c499de37d9823cc719363a339c631e1893a5aee
libjpeg-turbo-devel-1.5.3-12.el8.ppc64le.rpm SHA-256: a644fcfe288bcaca23f3d3de0dd3d7140343289780cc21475d27240d6acecf96
libjpeg-turbo-utils-1.5.3-12.el8.ppc64le.rpm SHA-256: 0f221c5fd78581a1a1c81ba15b722e144b7962b205c49149374909b27b6bd62c
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.ppc64le.rpm SHA-256: b25a584cf1d86dc00837702cdc320cafc7abedfc83897f3d767611b5fd674204
turbojpeg-1.5.3-12.el8.ppc64le.rpm SHA-256: 04ea1cbbf25b5a5b8301a426a9a8ad3f65937ee5a60c12624c75fa7fe4cd425e
turbojpeg-debuginfo-1.5.3-12.el8.ppc64le.rpm SHA-256: b44cf2565cc27141760e7e5d7516ece7fc7b2cc37019fa64a85003332f59a4c4

Red Hat Enterprise Linux for ARM 64 8

SRPM
libjpeg-turbo-1.5.3-12.el8.src.rpm SHA-256: c162dccef3b751d16bc929720db40cfa644b142aed85bb959b6283ea0e095dfc
aarch64
libjpeg-turbo-1.5.3-12.el8.aarch64.rpm SHA-256: c14963b9e2dce5a21fffcc7937ed3ee8126f72fd1006c0353b0f5282ab654d5e
libjpeg-turbo-debuginfo-1.5.3-12.el8.aarch64.rpm SHA-256: 3b1160b6a51c366ab643768451bb32c8a95ff2197cad874270575bc5faa99b6a
libjpeg-turbo-debugsource-1.5.3-12.el8.aarch64.rpm SHA-256: 87b3c5865dc56bb99f3e5fabc0b06ae4c0d6c73c1c39d2a4bc26dc370a3f85c8
libjpeg-turbo-devel-1.5.3-12.el8.aarch64.rpm SHA-256: 4019f64848f2f4df8a3973f9e54d248c695d7e131df4f3eeddba05927f597b9a
libjpeg-turbo-utils-1.5.3-12.el8.aarch64.rpm SHA-256: 2719446a7d9151aa98b931b1c857f2ff75243d6de556b295e8515d32309befd7
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.aarch64.rpm SHA-256: 3a0d01b06572b0cc9240f9926b3ddb02c97cc99eef9f5fc9f6ed66a1f40a7ce9
turbojpeg-1.5.3-12.el8.aarch64.rpm SHA-256: bd7fe71a0bbdd068846333fa2a8494a408d98e05fa5d533562999288344afc88
turbojpeg-debuginfo-1.5.3-12.el8.aarch64.rpm SHA-256: dc4734eb4d21e381932b79113437aaf8f2d9c34d06d7395ba5239dcf26744fe7

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
libjpeg-turbo-debuginfo-1.5.3-12.el8.i686.rpm SHA-256: 3179f8c712f36310d7e3b7c8d99fefb7da109d196323213c782b98a7693ed993
libjpeg-turbo-debuginfo-1.5.3-12.el8.x86_64.rpm SHA-256: b70ddfbe8648fb5e5812b035a4f310918047be5deeda38dfdd55238041b69e9a
libjpeg-turbo-debugsource-1.5.3-12.el8.i686.rpm SHA-256: 920a154ad3682afb66954c61d924e9326e529fc5d3e1a52e1afa00953d365216
libjpeg-turbo-debugsource-1.5.3-12.el8.x86_64.rpm SHA-256: d262910935a691b95f5ac4e03f98e4b750232c7d4521ddae975e41ce391ad9dc
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.i686.rpm SHA-256: 63a56ec072483f7af9b8acca83c798753f9f4587deaa3990da320fbfc04915d0
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.x86_64.rpm SHA-256: c757d7832212b4a03b3fef3c9b484827ef6dd7f62dd0929fec2d0cf9125f4d39
turbojpeg-debuginfo-1.5.3-12.el8.i686.rpm SHA-256: 9b56e4b806191c05f3e3978c0cba7dbf5a411afc9b40917c0162a4786701837c
turbojpeg-debuginfo-1.5.3-12.el8.x86_64.rpm SHA-256: caeef630c4e8abb66fb8469314d2430821edb492fab9718f79f3bd51028802d7
turbojpeg-devel-1.5.3-12.el8.i686.rpm SHA-256: eb996bd7e68bffd09556fe2953c8e8ad6d3a2f90ed0b6571a02c6949b18d12c3
turbojpeg-devel-1.5.3-12.el8.x86_64.rpm SHA-256: 7656ac2487c33063ab29777d37db280209c3a41d68e7b4de49011d4e5b5d4f4d

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
libjpeg-turbo-debuginfo-1.5.3-12.el8.ppc64le.rpm SHA-256: e799f517a8fcec53cbf68972822f4f70460c0f5d6f4e8015f96719b72df668f3
libjpeg-turbo-debugsource-1.5.3-12.el8.ppc64le.rpm SHA-256: fc4c468d840405d686aa54244c499de37d9823cc719363a339c631e1893a5aee
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.ppc64le.rpm SHA-256: b25a584cf1d86dc00837702cdc320cafc7abedfc83897f3d767611b5fd674204
turbojpeg-debuginfo-1.5.3-12.el8.ppc64le.rpm SHA-256: b44cf2565cc27141760e7e5d7516ece7fc7b2cc37019fa64a85003332f59a4c4
turbojpeg-devel-1.5.3-12.el8.ppc64le.rpm SHA-256: 3131262a488624ee46c7cd5b8cad048213b4b6b9c7a2ea36b96a7247074ffc1a

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
libjpeg-turbo-debuginfo-1.5.3-12.el8.aarch64.rpm SHA-256: 3b1160b6a51c366ab643768451bb32c8a95ff2197cad874270575bc5faa99b6a
libjpeg-turbo-debugsource-1.5.3-12.el8.aarch64.rpm SHA-256: 87b3c5865dc56bb99f3e5fabc0b06ae4c0d6c73c1c39d2a4bc26dc370a3f85c8
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.aarch64.rpm SHA-256: 3a0d01b06572b0cc9240f9926b3ddb02c97cc99eef9f5fc9f6ed66a1f40a7ce9
turbojpeg-debuginfo-1.5.3-12.el8.aarch64.rpm SHA-256: dc4734eb4d21e381932b79113437aaf8f2d9c34d06d7395ba5239dcf26744fe7
turbojpeg-devel-1.5.3-12.el8.aarch64.rpm SHA-256: 807e26110d3d0e91446dadaaf035e60cddd36c3daee162df8b8d0afe1473b11f

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
libjpeg-turbo-debuginfo-1.5.3-12.el8.s390x.rpm SHA-256: 32dc26601b1675a9bee54855303f6db03e404aa95f9cdfe5b2acef71a13a1b61
libjpeg-turbo-debugsource-1.5.3-12.el8.s390x.rpm SHA-256: c3b9b29a9c3b45949126bf9f3c3a5ac27e7c3e2ddf034da1710afde84eb686b3
libjpeg-turbo-utils-debuginfo-1.5.3-12.el8.s390x.rpm SHA-256: 72a4e1e5d90f6bc7cf4c60a42e8ed246688a28cb84d2875379f0517b0b8a9926
turbojpeg-debuginfo-1.5.3-12.el8.s390x.rpm SHA-256: 6f59251bc0a160485548ae37f78d426ce7e603e0589c7441c2e6901243732f7b
turbojpeg-devel-1.5.3-12.el8.s390x.rpm SHA-256: 6e2b95c9ee8692323c75d4009a76808bb70b6cb51b8536c2a33f0f8215e0ae92

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.