facebook/fresco

The vulnerability of the libjpeg-turbo

Open

#2,433 opened on Nov 12, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)Java (17,072 stars) (3,750 forks)batch import
buggood first issuehelp wanted

Description

Description

There is a vulnerability for libjpeg-turbo，Does this vulnerability exist in fresco, the libjpeg-turbo is used by fresco.

See details from https://nvd.nist.gov/vuln/detail/CVE-2018-14498

Reproduction

Solution

Additional Information

Contributor guide

Tech stack
javaandroidccpp
Domain
securitymobile
Issue type
security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Android image loading basicsCVE understandinglibjpeg turboFresco native library usage
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate Fresco's use of libjpeg turbo by examining native library dependencies in build files or native code. Check if the vulnerable version (CVE 2018-14498) is used and if a patch has been applied. Review existing comments in the issue for maintainer responses and look at Fresco's release notes or changelogs for any mention of this vulnerability.