Bug#1041103: libjpeg: CVE-2023-37836 CVE-2023-37837

[Moritz Mühlenhoff]

Source: libjpeg
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for libjpeg.

CVE-2023-37836[0]:
| libjpeg commit db33a6e was discovered to contain a reachable
| assertion via BitMapHook::BitMapHook at bitmaphook.cpp. This
| vulnerability allows attackers to cause a Denial of Service (DoS)
| via a crafted file.

https://github.com/thorfdbg/libjpeg/issues/87#BUG1
Fixed by: https://github.com/thorfdbg/libjpeg/commit/9e0cea29d7ba7a2c1e763865391bc94b336da25e
		

CVE-2023-37837[1]:
| libjpeg commit db33a6e was discovered to contain a heap buffer
| overflow via LineBitmapRequester::EncodeRegion at
| linebitmaprequester.cpp. This vulnerability allows attackers to
| cause a Denial of Service (DoS) via a crafted file.

https://github.com/thorfdbg/libjpeg/issues/87#BUG0
Fixed by: https://github.com/thorfdbg/libjpeg/commit/9e0cea29d7ba7a2c1e763865391bc94b336da25e


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-37836
    https://www.cve.org/CVERecord?id=CVE-2023-37836
[1] https://security-tracker.debian.org/tracker/CVE-2023-37837
    https://www.cve.org/CVERecord?id=CVE-2023-37837

Please adjust the affected versions in the BTS as needed.