get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade turbojpeg-devel | May 4, 2022 | Mar 7, 2019 |
| Alpine Linux | — | Upgrade libjpeg-turbo | Nov 8, 2019 | Mar 7, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libjpeg-turbo-staticUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utilsUpgrade turbojpeg-develUpgrade turbojpegUpgrade libjpeg-turboUpgrade libjpeg-turbo-debuginfo | Apr 27, 2020 | Mar 7, 2019 |
| Amazon_linux | — | Upgrade libjpeg-turbo | Sep 19, 2019 | Mar 7, 2019 |
| Centos_linux | — | Upgrade libjpeg-turbo-utils-debuginfoUpgrade turbojpeg-develUpgrade libjpeg-turbo-utilsUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-debuginfoUpgrade libjpeg-turbo-staticUpgrade libjpeg-turbo-develUpgrade libjpeg-turboUpgrade turbojpegUpgrade libjpeg-turbo-debugsource | Aug 28, 2019 | Mar 7, 2019 |
| Debian | — | Upgrade libjpeg-turbo | Mar 19, 2019 | Mar 7, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Dec 4, 2019 | Mar 7, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Nov 19, 2019 | Mar 7, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Sep 12, 2019 | Mar 7, 2019 |
| Oracle_linux | — | Upgrade libjpeg-turbo-staticUpgrade turbojpeg-develUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-develUpgrade libjpeg-turboUpgrade turbojpeg | Jul 21, 2020 | Jul 20, 2018 |
| Redhat_linux | — | Upgrade libjpeg-turbo-staticNo solution existsUpgrade turbojpeg-develUpgrade turbojpeg-debuginfoUpgrade turbojpegUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-debuginfoUpgrade libjpeg-turboUpgrade libjpeg-turbo-utils-debuginfoUpgrade libjpeg-turbo-debugsource | Aug 7, 2019 | Mar 7, 2019 |
| Rocky_linux | — | Upgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-utils-debuginfoUpgrade turbojpegUpgrade turbojpeg-develUpgrade libjpeg-turboUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-debuginfoUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-devel | Mar 12, 2024 | Mar 7, 2019 |
| Suse | — | Upgrade libjpeg8Upgrade libjpeg62-develUpgrade libjpeg8-devel-32bitUpgrade libturbojpeg0-32bitUpgrade libjpeg62-devel-32bitUpgrade libjpeg62Upgrade libjpeg62-32bitUpgrade libjpeg8-32bitUpgrade libjpeg8-develUpgrade libjpeg62-turboUpgrade libturbojpeg0Upgrade libjpeg-turbo | Apr 3, 2019 | Mar 7, 2019 |
| Ubuntu | — | Upgrade libjpeg-turbo-progs (Ubuntu Pro)Upgrade libjpeg-turbo-test (Ubuntu Pro)Upgrade libjpeg-turbo8Upgrade libjpeg-turbo8 (Ubuntu Pro)Upgrade libturbojpeg (Ubuntu Pro) | Nov 14, 2019 | Mar 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub