PT-2012-1150 · Libjpeg Turbo+1 · Libjpeg-Turbo+1

Atte Kettunen + 1 · Published 2012-08-13 · Updated 2025-01-21 · CVE-2012-2806

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libjpeg-turbo versions 1.2.0 through 1.2.0

Description The issue is related to a heap-based buffer overflow in the get sos function in jdmarker.c, which can be triggered by a large component count in the header of a JPEG image. This can cause a denial of service, resulting in an application crash, and potentially allow the execution of arbitrary code. The exploitation of this issue can be done remotely.

Recommendations For libjpeg-turbo version 1.2.0, update to version 1.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the processing of JPEG images with large component counts in the header until a patch is available.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2015-09673

CVE-2012-2806

SUSE-SU-2012_0997-1

Affected Products

Suse

Libjpeg-Turbo

References · 22

• https://bdu.fstec.ru/vul/2015-09673 · Security Note
• http://security.gentoo.org/glsa/glsa-201209-13.xml · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:121 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2806 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-2806 · Security Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• https://t.me/cvenotify/64465 · Telegram Post
• http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo?view=revision&revision=830 · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.5 · Note
• http://download.novell.com/patch/finder/?keywords=93ef07584e8267eac2fbd3642ae99254 · Note
• http://securityfocus.com/bid/54480 · Note
• http://openwall.com/lists/oss-security/2012/07/17/3 · Note
• http://secunia.com/advisories/50753 · Note
• http://download.novell.com/patch/finder/?keywords=30382ed87257d139959fb1fad29dd127 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76952 · Note