[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 3305-1] libstb security update



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3305-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/        Adrian Bunk <bunk@debian.org>
January 31, 2023                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libstb
Version        : 0.0~git20180212.15.e6afb9c-1+deb10u1
CVE ID         : CVE-2018-16981 CVE-2019-13217 CVE-2019-13218 CVE-2019-13219 
                 CVE-2019-13220 CVE-2019-13221 CVE-2019-13222 CVE-2019-13223 
                 CVE-2021-28021 CVE-2021-37789 CVE-2021-42715 CVE-2022-28041 
                 CVE-2022-28042
Debian Bug     : 934966 1014530 1023693 1014531 1014532

Several vulnerabilities have been fixed in the libstb library.

CVE-2018-16981

    Heap-based buffer overflow in stbi__out_gif_code().

CVE-2019-13217

    Heap buffer overflow in the Vorbis start_decoder().

CVE-2019-13218

    Division by zero in the Vorbis predict_point().

CVE-2019-13219

    NULL pointer dereference in the Vorbis get_window().

CVE-2019-13220

    Uninitialized stack variables in the Vorbis start_decoder().

CVE-2019-13221

    Buffer overflow in the Vorbis compute_codewords().

CVE-2019-13222

    Out-of-bounds read of a global buffer in the Vorbis draw_line().

CVE-2019-13223

    Reachable assertion in the Vorbis lookup1_values().

CVE-2021-28021

    Buffer overflow in stbi__extend_receive().

CVE-2021-37789

    Heap-based buffer overflow in stbi__jpeg_load().

CVE-2021-42715

    The HDR loader parsed truncated end-of-file RLE scanlines as an 
    infinite sequence of zero-length runs.

CVE-2022-28041

    Integer overflow in stbi__jpeg_decode_block_prog_dc().

CVE-2022-28042

    Heap-based use-after-free in stbi__jpeg_huff_decode().

For Debian 10 buster, these problems have been fixed in version
0.0~git20180212.15.e6afb9c-1+deb10u1.

We recommend that you upgrade your libstb packages.

For the detailed security status of libstb please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libstb

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmPZj1IACgkQiNJCh6LY
mLH+lA/8DtWLi71FsiGFnOVokrZsHnR8eVDQiK5ldjmLgiynRzEeZfNMwYjG86xH
hsmk6SVeFI8CEKeXzJq36BOcP2VCpq/lR4WYfPkl7U2txnheTQTUjIn7mXG4GQOB
M5XtW2EZTKyh5E/ei51cVRQBOCssKMPGpV1VkPSA1DmWZjPN9c0OOJEwsJzq3tHZ
2HqtNzyzFruk8oHDRfATJCko1N+6LtKVMEu8sgJTrwVNSetY2YjBikoJP4BvCxFb
gHB90EBh7ezvvgCQ2152YRtTTuLcK0C1cUgVu+47JRPVBkciVj49hHN6QgoHZPpa
EvJr7tFKkAW9oKVF2N8bM+NH4GIRtNpwpWXCiQn7TXLXEPAtJzr2HE7TLX4hQcry
i04SfrPXiTlvHjNXx7h81B5q7ZmWncNsIXAr9f2nmrEMP8s4zUtujJ3d7qs94bFp
Rf09VPlWfw/ZVBMvSd3xz8u/igKvKC1GlVz8nrcRdWYeyUWSIKSnJP/f4coTPmXI
6zweAyWRVYQgh7Em7fKXRw1Q9w8JqBMPVXRqfRMjodgKG3gKA2OafIgMOhERr0CQ
aiVj0v4Ln9guDTkJpfSI4nmfmU6EGldfE5K7SMB8NrExWiebjN3y5JBM7hzB3aKe
4TKx3dppa0hHd5e4jdlY/AepKtjSBgWgSc38OqA8C1/fGk1qNzc=
=Qh3l
-----END PGP SIGNATURE-----


Reply to: