The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libjpeg-turbo-develUpgrade turbojpeg-develUpgrade turbojpegUpgrade libjpeg-turbo-utilsUpgrade libjpeg-turbo | Mar 7, 2023 | Jun 18, 2022 |
| Amazon Linux Ami 2 | — | Upgrade turbojpeg-develUpgrade libjpeg-turbo-debuginfoUpgrade libjpeg-turbo-utilsUpgrade turbojpegUpgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Aug 24, 2023 | Jun 18, 2022 |
| Centos_linux | — | Upgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turboUpgrade libjpeg-turbo-debuginfoUpgrade libjpeg-turbo-utilsUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-utils-debuginfoUpgrade libjpeg-turbo-devel | Mar 7, 2023 | Jun 18, 2022 |
| Debian | — | Upgrade libjpeg-turbo | Jul 30, 2024 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libjpeg-turbo | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-devel | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libjpeg-turbo-develUpgrade libjpeg-turbo | Oct 11, 2022 | Jun 18, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libjpeg-turbo | Sep 14, 2022 | Jun 18, 2022 |
| Oracle_linux | — | Upgrade libjpeg-turboUpgrade libjpeg-turbo-utilsUpgrade turbojpeg-develUpgrade turbojpegUpgrade libjpeg-turbo-devel | Mar 6, 2023 | Apr 7, 2021 |
| Redhat_linux | — | Upgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-debuginfoUpgrade libjpeg-turbo-utils-debuginfoUpgrade turbojpegUpgrade turbojpeg-develUpgrade libjpeg-turboUpgrade turbojpeg-debuginfoUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utils | Mar 7, 2023 | Jun 18, 2022 |
| Rocky_linux | — | Upgrade libjpeg-turbo-debugsourceUpgrade libjpeg-turbo-utils-debuginfoUpgrade turbojpeg-debuginfoUpgrade turbojpeg-develUpgrade libjpeg-turboUpgrade libjpeg-turbo-develUpgrade libjpeg-turbo-utilsUpgrade turbojpegUpgrade libjpeg-turbo-debuginfo | Mar 12, 2024 | Jun 18, 2022 |
| Ubuntu | — | Upgrade libjpeg-turbo8Upgrade libturbojpeg | Sep 23, 2022 | Jun 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub