Attachment 218650 Details for Bug 250190 – VuXML entry, turbo-jpeg and mozjpeg

[patch] VuXML entry, turbo-jpeg and mozjpeg

vuxml.patch (text/plain), 2.31 KB, created by Daniel Engberg on 2020-10-10 19:03:51 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Engberg

Created: 2020-10-10 19:03:51 UTC

Size: 2.31 KB

patch

obsolete

>diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml
>index e85f7ea6784c..a2fab951b379 100644
>--- a/security/vuxml/vuln.xml
>+++ b/security/vuxml/vuln.xml
>@@ -58,6 +58,63 @@ Notes:
> * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+ <vuln vid="040707f9-0b2a-11eb-8834-00155d01f202">
>+ <topic>mozjpeg -- heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file</topic>
>+ <affects>
>+ <package>
>+	<name>mozjpeg</name>
>+	<range><lt>4.0.0</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	NIST reports:
>+	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2020-13790">
>+	<ul>
>+	 <li>Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.</li>
>+	</ul>
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2020-13790</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13790</url>
>+ </references>
>+ <dates>
>+ <discovery>2020-06-03</discovery>
>+ <entry>2020-10-10</entry>
>+ </dates>
>+ </vuln>
>+
>+ <vuln vid="23a667c7-0b28-11eb-8834-00155d01f202">
>+ <topic>libjpeg-turbo -- Issue in the PPM reader causing a buffer overrun in cjpeg, TJBench, or the tjLoadImage() function.</topic>
>+ <affects>
>+ <package>
>+	<name>libjpeg-turbo</name>
>+	<range><lt>2.0.4</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	libjpeg-turbo releases reports:
>+	<blockquote cite="https://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.5">
>+	 This release fixes the following security issue:
>+	 <ul>
>+	 <li>Heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.</li>
>+	 </ul>
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2020-13790</cvename>
>+ <url>https://nvd.nist.gov/vuln/detail/CVE-2020-13790</url>
>+ </references>
>+ <dates>
>+ <discovery>2020-06-03</discovery>
>+ <entry>2020-10-10</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="b07bdd3c-0809-11eb-a3a4-0019dbb15b3f">
> <topic>Payara -- path trasversal flaw via either loc/con parameters in Eclipse Mojarra</topic>
> <affects>

Actions: View | Diff

Attachments on bug 250190: 218602 | 218650