The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libjpeg-turboUpgrade turbojpegUpgrade turbojpeg-develUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utils | Mar 7, 2023 | Jun 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libjpeg-turbo-develUpgrade libjpeg-turboUpgrade turbojpegUpgrade libjpeg-turbo-debuginfoUpgrade turbojpeg-develUpgrade libjpeg-turbo-utils | Aug 24, 2023 | Jun 18, 2022 |
| Centos_linux | — | Upgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-utils-debuginfoUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-develUpgrade libjpeg-turboUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-debuginfo | Mar 7, 2023 | Jun 18, 2022 |
| Debian | — | Upgrade libjpeg-turbo | Jul 30, 2024 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libjpeg-turbo | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libjpeg-turbo-develUpgrade libjpeg-turbo | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libjpeg-turbo | Sep 14, 2022 | Jun 18, 2022 |
| Oracle_linux | — | Upgrade turbojpegUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turboUpgrade turbojpeg-devel | Mar 6, 2023 | Apr 7, 2021 |
| Redhat_linux | — | Upgrade libjpeg-turbo-develUpgrade libjpeg-turboUpgrade libjpeg-turbo-utils-debuginfoUpgrade turbojpeg-develUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-utilsUpgrade turbojpegUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-debuginfo | Mar 7, 2023 | Jun 18, 2022 |
| Rocky_linux | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo-develUpgrade turbojpegUpgrade libjpeg-turbo-debuginfoUpgrade turbojpeg-debuginfoUpgrade turbojpeg-develUpgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-utils-debuginfo | Mar 12, 2024 | Jun 18, 2022 |
| Ubuntu | — | Upgrade libjpeg-turbo8Upgrade libturbojpeg | Sep 23, 2022 | Jun 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub