Debian Long Term Support / LTS Security Information / 2021 / Security Information -- DLA-2868-1 advancecomp

Debian Security Advisory

DLA-2868-1 advancecomp -- LTS security update

Date Reported:

29 Dec 2021

Affected Packages:

advancecomp

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 889270, Bug 923416, Bug 928729, Bug 928730.
In Mitre's CVE dictionary: CVE-2018-1056, CVE-2019-8379, CVE-2019-8383, CVE-2019-9210.

More information:

Several vulnerabilities have been fixed in the AdvanceCOMP recompression utilities.

• CVE-2018-1056

  Out-of-bounds heap buffer read in advzip.

• CVE-2019-8379

  NULL pointer dereference in be_uint32_read().

• CVE-2019-8383

  Invalid memory access in adv_png_unfilter_8().

• CVE-2019-9210

  Integer overflow in advpng with invalid PNG size.

For Debian 9 stretch, these problems have been fixed in version 1.20-1+deb9u1.

We recommend that you upgrade your advancecomp packages.

For the detailed security status of advancecomp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/advancecomp

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS