-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:273 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : libjpeg Date : November 21, 2013 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated libjpeg packages fix security vulnerabilities: libjpeg 6b and libjpeg-turbo will use uninitialized memory when decoding images with missing SOS data for the luminance component (Y) in presence of valid chroma data (Cr, Cb) (CVE-2013-6629). libjpeg-turbo will use uninitialized memory when handling Huffman tables (CVE-2013-6630). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6629 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6630 http://advisories.mageia.org/MGASA-2013-0333.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 4b3246c5236cce36539c5a3f3383e141 mbs1/x86_64/jpeg-progs-1.2.0-5.2.mbs1.x86_64.rpm e903e2d84d5975c84feb30bf61e9fc27 mbs1/x86_64/lib64jpeg62-1.2.0-5.2.mbs1.x86_64.rpm ed2b02157825d772109fd321a4bd8da5 mbs1/x86_64/lib64jpeg8-1.2.0-5.2.mbs1.x86_64.rpm 6257733e093dc32b01a6e9fe695f75c5 mbs1/x86_64/lib64jpeg-devel-1.2.0-5.2.mbs1.x86_64.rpm f5880a061f6ffe706c92619516cdb483 mbs1/x86_64/lib64jpeg-static-devel-1.2.0-5.2.mbs1.x86_64.rpm e9d23e700d88863fa51623fa318e9203 mbs1/SRPMS/libjpeg-1.2.0-5.2.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFSjc42mqjQ0CJFipgRAjjdAKCyA6j70X2L2kyFbcb+Lf9DfvdGzQCgjN3I zZpqCNbcAEXpDneYn4hAA/o= =5rwB -----END PGP SIGNATURE-----