PT-2023-21504 · Unknown+2 · Libjpeg-Turbo+2

Cl3Nn0 · Publicado 2023-05-25 · Atualizado 2026-03-05 · CVE-2023-2804

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libjpeg-turbo (affected versions not specified)

Description A heap-based buffer overflow issue was discovered in the h2v2 merged upsample internal() function of the jdmrgext.c file. The issue can only be exploited with 12-bit data precision when the range of the sample data type exceeds the valid sample range. An attacker could craft a 12-bit lossless JPEG image containing out-of-range 12-bit samples, leading to a segmentation fault or buffer overflow when an application attempts to decompress the image using merged upsampling, causing the application to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Heap Based Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-122

CWE-787

Identificadores relacionados

ALT-PU-2023-4129

ALT-PU-2024-1887

BDU:2026-01703

CVE-2023-2804

OPENSUSE-SU-2024:13552-1

Produtos afetados

Alt Linux

Windows

Libjpeg-Turbo

Referências · 21

• 🔥 https://github.com/libjpeg-turbo/libjpeg-turbo/issues/675 · Exploit
• 🔥 https://github.com/libjpeg-turbo/libjpeg-turbo/issues/668#issuecomment-1492586118 · Exploit
• https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9f756bc67a84d4566bf74a0c2432aa55da404021 · Correção
• https://bdu.fstec.ru/vul/2026-01703 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2023-2804 · Nota
• https://security.alpinelinux.org/vuln/CVE-2023-2804 · Nota
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01006.html · Nota
• https://t.me/cvenotify/51177 · Publicação no Telegram
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-2804 · Aviso do Fabricante
• https://t.me/cvenotify/71297 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2804 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2804 · Nota de Segurança
• https://sentinelone.com/vulnerability-database/cve-2023-2804 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2804 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-2804 · Aviso do Fabricante