The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libjpeg-turbo | Aug 30, 2017 | Nov 18, 2013 |
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2014-001 | Aug 28, 2015 | Nov 18, 2013 |
| Apple Osx Imageio | — | Apply OS X security update 2014-001Upgrade macOS to the latest version | Mar 3, 2014 | Nov 18, 2013 |
| Centos_linux | — | Upgrade libjpeg-turbo-staticUpgrade libjpegUpgrade libjpeg-develUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo | Dec 1, 2016 | Nov 18, 2013 |
| Debian | — | Upgrade libjpeg-turboUpgrade libjpeg8Upgrade openjdk-7Upgrade chromium-browserUpgrade libjpeg6b | Jul 30, 2024 | Nov 19, 2013 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 19, 2016 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade linux-firefoxUpgrade seamonkeyUpgrade linux-thunderbirdUpgrade linux-seamonkey | Dec 10, 2025 | Dec 14, 2013 |
| Gentoo Linux | — | Upgrade media-libs/libjpeg-turbo.Upgrade dev-java/icedtea-bin. | Oct 30, 2017 | Nov 18, 2013 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Nov 22, 2013 | Nov 12, 2013 |
| Hpux | — | Update Jre70.JRE70-IPF32 to the latest versionUpdate Jre60.JRE60-COM to the latest versionUpdate Jre60.JRE60-PWV2-H to the latest versionUpdate Jre60.JRE60-PA20 to the latest versionUpdate Jdk60.JDK60-IPF64 to the latest versionUpdate Jre70.JRE70-IPF32-HS to the latest versionUpdate Jdk60.JDK60-IPF32 to the latest versionUpdate Jre70.JRE70-IPF64 to the latest versionUpdate Jre60.JRE60-IPF32 to the latest versionUpdate Jre60.JRE60-PWV2 to the latest versionUpdate Jre60.JRE60-PNV2-H to the latest versionUpdate Jre60.JRE60-IPF64-HS to the latest versionUpdate Jdk70.JDK70-COM to the latest versionUpdate Jre60.JRE60-IPF64 to the latest versionUpdate Jre60.JRE60-PA20W to the latest versionUpdate Jre70.JRE70-COM to the latest versionUpdate Jre70.JRE70-IPF64-HS to the latest versionUpdate Jdk70.JDK70-IPF64 to the latest versionUpdate Jre60.JRE60-PA20W-HS to the latest versionUpdate Jdk60.JDK60-PWV2 to the latest versionUpdate Jre60.JRE60-PA20-HS to the latest versionUpdate Jdk60.JDK60-PA20W to the latest versionUpdate Jdk60.JDK60-COM to the latest versionUpdate Jdk60.JDK60 to the latest versionUpdate Jdk60.JDK60-PA20 to the latest versionUpdate Jdk60.JDK60-PNV2 to the latest versionUpdate Jdk70.JDK70-IPF32 to the latest versionUpdate Jdk70.JDK70-DEMO to the latest versionUpdate Jre60.JRE60-IPF32-HS to the latest versionUpdate Jre60.JRE60-PNV2 to the latest versionUpdate Jre60.JRE60-COM-DOC to the latest version | Aug 11, 2017 | Nov 18, 2013 |
| Ibm Aix | — | Apply the fix or workaround for java_apr2014_advisory | Nov 30, 2017 | Nov 18, 2013 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Apr 17, 2014 | Nov 18, 2013 |
| Mfsa2013 116 | — | Upgrade to Mozilla Firefox ESR version 24.2Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 26.0 | Dec 12, 2013 | Nov 18, 2013 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.23.0 | Dec 8, 2014 | Nov 18, 2013 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 24.2 | Dec 12, 2013 | Nov 18, 2013 |
| Msft | — | April, 2017 Security Only Quality Update for Windows Embedded Standard 7 (KB4015546)Security Update for Windows Server 2008 for x64-based Systems (KB4014652)Security Update for WES09 and POSReady 2009 (KB4014794)2017-04 Cumulative Update for Microsoft Windows 10, version 1703 (KB4015583)Security Update for WES09 and POSReady 2009 (KB4015383)Security Update for WES09 and POSReady 2009 (KB4014652)April, 2017 Security Only Quality Update for Windows 7 for x64-based Systems (KB4015546)Security Update for Windows Server 2008 for x64-based Systems (KB4014794)2017-04 Cumulative Update for Microsoft Windows 10, version 1607 (KB4015217)2017-04 Cumulative Update for Microsoft Windows 10, version 1507 (KB4015221)Security Update for Microsoft Silverlight (KB4017094)Security Update for Windows Vista for x64-based Systems (KB4014652)Security Update for Windows Vista for x64-based Systems (KB4015383)Security Update for Windows Vista for x64-based Systems (KB4014794)April, 2017 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4015546)Security Update for Windows Vista (KB4014652)April, 2017 Security Only Quality Update for Windows 7 (KB4015546)April, 2017 Security Only Quality Update for Windows Embedded 8 Standard (KB4015548)Security Update for Windows Server 2008 for x64-based Systems (KB4015383)2017-04 Cumulative Update for Microsoft Windows Server 2012 (KB4015548)April, 2017 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4015548)April, 2017 Security Only Quality Update for Windows 8.1 (KB4015547)2017-04 Cumulative Update for Microsoft Windows 10, version 1511 (KB4015219)April, 2017 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4015546)2017-04 Cumulative Update for Microsoft Windows Server 2012 R2 (KB4015547)Security Update for Windows Vista (KB4015383)Security Update for Windows Server 2008 for Itanium-based Systems (KB4015383)Security Update for Windows Server 2008 (KB4014794)Security Update for Windows Vista (KB4014794)April, 2017 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4015547)Security Update for Windows Server 2008 for Itanium-based Systems (KB4014794)2017-04 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4015217)April, 2017 Security Only Quality Update for Windows Server 2008 R2 for Itanium-based Systems (KB4015546)Security Update for Windows Server 2008 (KB4015383)Security Update for Windows Server 2008 (KB4014652) | Apr 11, 2017 | Apr 11, 2017 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 38.4.0-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3/documentation to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade database/sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.9.2-0.175.3.8.0.2.0 on Solaris 11.3Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | May 29, 2017 | Nov 18, 2013 |
| Oracle_linux | — | Upgrade libjpegUpgrade libjpeg-turboUpgrade libjpeg-turbo-staticUpgrade libjpeg-develUpgrade libjpeg-turbo-devel | Oct 16, 2024 | Nov 15, 2013 |
| Suse | — | Upgrade java-1_6_0-ibm-alsaUpgrade chromium-desktop-gnomeUpgrade java-1_5_0-ibm-alsaUpgrade java-1_7_0-openjdk-accessibilityUpgrade java-1_7_0-openjdk-develUpgrade MozillaThunderbird-buildsymbolsUpgrade java-1_7_0-ibmUpgrade java-1_5_0-ibmUpgrade chromium-ffmpegsumoUpgrade java-1_7_0-openjdk-demoUpgrade seamonkey-dom-inspectorUpgrade java-1_7_0-openjdk-srcUpgrade chromium-desktop-kdeUpgrade seamonkeyUpgrade java-1_7_0-openjdk-headlessUpgrade java-1_7_0-ibm-pluginUpgrade java-1_6_0-ibm-fontsUpgrade java-1_6_0-ibm-devel-32bitUpgrade seamonkey-venkmanUpgrade java-1_5_0-ibm-jdbcUpgrade java-1_7_0-openjdkUpgrade chromedriverUpgrade MozillaFirefox-develUpgrade chromium-suid-helperUpgrade java-1_5_0-ibm-develUpgrade java-1_6_0-ibm-pluginUpgrade java-1_5_0-ibm-alsa-32bitUpgrade java-1_6_0-ibm-develUpgrade java-1_6_0-ibm-32bitUpgrade seamonkey-ircUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_5_0-ibm-fontsUpgrade mozillafirefox-buildsymbolsUpgrade java-1_7_0-ibm-jdbcUpgrade java-1_6_0-ibm-plugin-32bitUpgrade MozillaFirefox-translations-commonUpgrade sle-sdk-releaseUpgrade java-1_7_0-ibm-alsaUpgrade java-1_6_0-ibmUpgrade seamonkey-translations-otherUpgrade MozillaThunderbird-translations-commonUpgrade chromiumUpgrade java-1_7_0-ibm-develUpgrade seamonkey-translations-commonUpgrade java-1_5_0-ibm-32bitUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-develUpgrade java-1_5_0-ibm-pluginUpgrade java-1_5_0-ibm-devel-32bitUpgrade MozillaFirefoxUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade java-1_7_0-openjdk-javadocUpgrade java-1_6_0-ibm-alsa-32bitUpgrade enigmail | Feb 17, 2015 | Nov 18, 2013 |
| Ubuntu | — | Upgrade libjpeg-turbo8Upgrade firefoxUpgrade libjpeg62Upgrade thunderbirdUpgrade libturbojpeg | Nov 8, 2024 | Nov 19, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub