SB2021041230 - Fedora 33 update for leptonica, mingw-leptonica

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2020-36281)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in pixFewColorsOctcubeQuantMixed in colorquant1.c. A remote attacker can trigger out-of-bounds read error and cause a denial of service condition on the system.

2) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2020-36277)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack. 

The vulnerability exists due to an incorrect left shift in pixConvert2To8 in pixconv.c. A remote attacker can cause a denial of service condition on the target system. 

3) Out-of-bounds read (CVE-ID: CVE-2020-36278)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack

The vulnerability exists due to a boundary condition in the "findNextBorderPixel" in ccbord.c. A remote attacker can trigger out-of-bounds read error and cause a denial of service condition on the system.

4) Out-of-bounds read (CVE-ID: CVE-2020-36279)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in rasteropGeneralLow, related to adaptmap_reg.c and adaptmap.c. A remote attacker can trigger out-of-bounds read error and cause a denial of service condition on the system.

5) Out-of-bounds read (CVE-ID: CVE-2020-36280)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in pixReadFromTiffStream, related to tiffio.c. A remote attacker can trigger out-of-bounds read error and cause a denial of service condition on the system.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2021-f5f2803fff