The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade turbojpeg-develUpgrade turbojpegUpgrade libjpeg-turbo-develUpgrade libjpeg-turboUpgrade libjpeg-turbo-utils | Mar 7, 2023 | Jun 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-debuginfoUpgrade turbojpeg-develUpgrade turbojpegUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo | Aug 24, 2023 | Jun 18, 2022 |
| Centos_linux | — | Upgrade libjpeg-turbo-develUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-utils-debuginfoUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turboUpgrade libjpeg-turbo-debuginfo | Mar 7, 2023 | Jun 18, 2022 |
| Debian | — | Upgrade libjpeg-turbo | Jul 30, 2024 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libjpeg-turbo | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libjpeg-turbo | Sep 14, 2022 | Jun 18, 2022 |
| Oracle_linux | — | Upgrade libjpeg-turbo-develUpgrade turbojpegUpgrade turbojpeg-develUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo | Mar 6, 2023 | Apr 7, 2021 |
| Redhat_linux | — | Upgrade libjpeg-turboUpgrade turbojpegUpgrade turbojpeg-develUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-utils-debuginfoUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-debuginfo | Mar 7, 2023 | Jun 18, 2022 |
| Rocky_linux | — | Upgrade libjpeg-turbo-debuginfoUpgrade libjpeg-turbo-utilsUpgrade turbojpegUpgrade libjpeg-turboUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-develUpgrade turbojpeg-develUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-utils-debuginfo | Mar 12, 2024 | Jun 18, 2022 |
| Ubuntu | — | Upgrade libjpeg-turbo8Upgrade libturbojpeg | Sep 23, 2022 | Jun 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub