PT-2019-13496 · Libjpeg Turbo+1 · Libjpeg-Turbo+1

CVE-2019-13960 · Publicado 2019-07-18 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libjpeg-turbo version 2.0.2

Description The issue arises when processing an invalid progressive JPEG image with incorrect width and height values in the image header, potentially leading to a large amount of memory usage. This could result in a denial of service. The vendor suggests that applications should interpret libjpeg warnings as fatal errors, aborting decompression, and/or set limits on resource consumption or image sizes to mitigate this issue.

Recommendations For libjpeg-turbo version 2.0.2, consider setting limits on resource consumption or image sizes to prevent excessive memory usage. Additionally, applications should be configured to interpret libjpeg warnings as fatal errors, aborting decompression when such warnings occur.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

ALT-PU-2021-1392

CVE-2019-13960

Produtos afetados

Alt Linux

Libjpeg-Turbo

Referências · 4

• 🔥 https://github.com/libjpeg-turbo/libjpeg-turbo/issues/337 · Exploit
• 🔥 https://libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2019-13960 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13960 · Nota de Segurança