-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3305-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Adrian Bunk <b...@debian.org> January 31, 2023 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : libstb Version : 0.0~git20180212.15.e6afb9c-1+deb10u1 CVE ID : CVE-2018-16981 CVE-2019-13217 CVE-2019-13218 CVE-2019-13219 CVE-2019-13220 CVE-2019-13221 CVE-2019-13222 CVE-2019-13223 CVE-2021-28021 CVE-2021-37789 CVE-2021-42715 CVE-2022-28041 CVE-2022-28042 Debian Bug : 934966 1014530 1023693 1014531 1014532 Several vulnerabilities have been fixed in the libstb library. CVE-2018-16981 Heap-based buffer overflow in stbi__out_gif_code(). CVE-2019-13217 Heap buffer overflow in the Vorbis start_decoder(). CVE-2019-13218 Division by zero in the Vorbis predict_point(). CVE-2019-13219 NULL pointer dereference in the Vorbis get_window(). CVE-2019-13220 Uninitialized stack variables in the Vorbis start_decoder(). CVE-2019-13221 Buffer overflow in the Vorbis compute_codewords(). CVE-2019-13222 Out-of-bounds read of a global buffer in the Vorbis draw_line(). CVE-2019-13223 Reachable assertion in the Vorbis lookup1_values(). CVE-2021-28021 Buffer overflow in stbi__extend_receive(). CVE-2021-37789 Heap-based buffer overflow in stbi__jpeg_load(). CVE-2021-42715 The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. CVE-2022-28041 Integer overflow in stbi__jpeg_decode_block_prog_dc(). CVE-2022-28042 Heap-based use-after-free in stbi__jpeg_huff_decode(). For Debian 10 buster, these problems have been fixed in version 0.0~git20180212.15.e6afb9c-1+deb10u1. We recommend that you upgrade your libstb packages. For the detailed security status of libstb please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libstb Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmPZj1IACgkQiNJCh6LY mLH+lA/8DtWLi71FsiGFnOVokrZsHnR8eVDQiK5ldjmLgiynRzEeZfNMwYjG86xH hsmk6SVeFI8CEKeXzJq36BOcP2VCpq/lR4WYfPkl7U2txnheTQTUjIn7mXG4GQOB M5XtW2EZTKyh5E/ei51cVRQBOCssKMPGpV1VkPSA1DmWZjPN9c0OOJEwsJzq3tHZ 2HqtNzyzFruk8oHDRfATJCko1N+6LtKVMEu8sgJTrwVNSetY2YjBikoJP4BvCxFb gHB90EBh7ezvvgCQ2152YRtTTuLcK0C1cUgVu+47JRPVBkciVj49hHN6QgoHZPpa EvJr7tFKkAW9oKVF2N8bM+NH4GIRtNpwpWXCiQn7TXLXEPAtJzr2HE7TLX4hQcry i04SfrPXiTlvHjNXx7h81B5q7ZmWncNsIXAr9f2nmrEMP8s4zUtujJ3d7qs94bFp Rf09VPlWfw/ZVBMvSd3xz8u/igKvKC1GlVz8nrcRdWYeyUWSIKSnJP/f4coTPmXI 6zweAyWRVYQgh7Em7fKXRw1Q9w8JqBMPVXRqfRMjodgKG3gKA2OafIgMOhERr0CQ aiVj0v4Ln9guDTkJpfSI4nmfmU6EGldfE5K7SMB8NrExWiebjN3y5JBM7hzB3aKe 4TKx3dppa0hHd5e4jdlY/AepKtjSBgWgSc38OqA8C1/fGk1qNzc= =Qh3l -----END PGP SIGNATURE-----