CVE-2023-2804。libjpeg-turbo

[aLittleGreens]

There is a security vulnerability in libjpeg-turbo, which originates from the heap buffer overflow at /libjpeg-turbo/jdmrext.c:126 in h2v2_merged_upsample_internal().

[softavail]

I run into the same issue.
Bellow are the vulnerability details
https://www.cvedetails.com/cve/CVE-2023-2804

It is not very clear which version of libjpeg-turbo fixes this issue, but I guess it is 2.1.90

Bellow is a link with the fix
https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9f756bc67a84d4566bf74a0c2432aa55da404021

Latest fresco v3.4.0 depends on libjpeg-turbo 2.1.5.1
I suppose the fix is to make fresco library to depend from libjpeg-turbo where this vulnerability is fixed

Thank you!