Upgrade libjpeg-turbo version to 2.1.4 to fix CVE-2020-35538 (#3755)

* Upgrade libjpeg-turbo version to 2.1.4 to fix CVE-2020-35538

* update change log

SPECS/libjpeg-turbo/libjpeg-turbo.signatures.json

@@ -1,5 +1,5 @@
 {
  "Signatures": {
-  "libjpeg-turbo-2.1.2.tar.gz": "09b96cb8cbff9ea556a9c2d173485fd19488844d55276ed4f42240e1e2073ce5"
+  "libjpeg-turbo-2.1.4.tar.gz": "d3ed26a1131a13686dfca4935e520eb7c90ae76fbc45d98bb50a8dc86230342b"
  }
 }

SPECS/libjpeg-turbo/libjpeg-turbo.spec

@@ -1,6 +1,6 @@
 Summary:        fork of the original IJG libjpeg which uses SIMD.
 Name:           libjpeg-turbo
-Version:        2.1.2
+Version:        2.1.4
 Release:        1%{?dist}
 License:        IJG
 Vendor:         Microsoft Corporation
@@ -63,6 +63,9 @@ popd
 %{_libdir}/cmake/%{name}/%{name}*.cmake
 
 %changelog
+* Tue Sep 13 2022 Nan Liu <liunan@microsoft.com> - 2.1.4-1
+- Upgrade to version 2.1.4 to fix CVE-2020-35538
+
 * Fri Jan 07 2022 Henry Li <lihl@microsoft.com> - 2.1.2-1
 - Upgrade to version 2.1.2
 - Add related cmake files to libjpeg-turbo-devel pacakge

cgmanifest.json

@@ -8851,8 +8851,8 @@
         "type": "other",
         "other": {
           "name": "libjpeg-turbo",
-          "version": "2.1.2",
-          "downloadUrl": "http://downloads.sourceforge.net/libjpeg-turbo/libjpeg-turbo-2.1.2.tar.gz"
+          "version": "2.1.4",
+          "downloadUrl": "http://downloads.sourceforge.net/libjpeg-turbo/libjpeg-turbo-2.1.4.tar.gz"
         }
       }
     },