PT-2013-1155 · Libjpeg Turbo Developers+10 · Libjpeg-Turbo+10
Michal Zalewski
·
Published
2013-11-12
·
Updated
2024-12-12
·
CVE-2013-6629
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
libjpeg versions 6b
libjpeg-turbo versions 1.2.1 through 1.3.0
Description
The issue is related to the handling of JPEG images, which can lead to the disclosure of sensitive information from uninitialized memory locations. This can be exploited remotely. The
get sos function in jdmarker.c does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers. An information disclosure vulnerability exists within the open-source libjpeg image-processing library where it fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization (ASLR) bypass.Recommendations
For libjpeg version 6b, update to a version that fixes the vulnerability.
For libjpeg-turbo versions 1.2.1 through 1.3.0, update to a version that fixes the vulnerability.
As a temporary workaround, consider disabling the handling of JPEG images until a patch is available.
Restrict access to the vulnerable library to minimize the risk of exploitation.
Exploit
Fix
RCE
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Google Chrome
Hp-Ux
Ibm Aix
Java Platform
Red Hat
Suse
Windows
Libjpeg
Libjpeg-Turbo