Bug#373672: libjpeg-mmx: CVE-2006-3005: memory exhaustion

2006-06-16 Thread Alec Berryman
Moritz Muehlenhoff on 2006-06-15 12:10:15 +0200: > On Wed, Jun 14, 2006 at 05:53:45PM -0500, Alec Berryman wrote: > > > Although the CVE is Gentoo-specific, Debian's libjpeg-mmx is not built > > with --maxmem enabled, making it vulnerable. I have attached a trivial > > patch to enable --maxmem t

Bug#373672: libjpeg-mmx: CVE-2006-3005: memory exhaustion

2006-06-15 Thread Moritz Muehlenhoff
On Wed, Jun 14, 2006 at 05:53:45PM -0500, Alec Berryman wrote: > Package: libjpeg-mmx > Severity: important > Tags: security patch > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > CVE-2006-3005: "The JPEG library in media-libs/jpeg before 6b-r7 on > Gentoo Linux is built without the -maxme

Bug#373672: libjpeg-mmx: CVE-2006-3005: memory exhaustion

2006-06-14 Thread Alec Berryman
Package: libjpeg-mmx Severity: important Tags: security patch -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2006-3005: "The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature, which could allow context-dependent attackers to cause a denial of ser