PT-2019-6390 · Libjpeg Turbo+9 · Libjpeg-Turbo+9

Lxkeklxo · Published 2019-12-05 · Updated 2024-09-23 · CVE-2020-17541

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Libjpeg-turbo versions (affected versions not specified)

Description The issue is related to a stack-based buffer overflow in the transform component of Libjpeg-turbo. A remote attacker can exploit this by sending a malformed jpeg file, potentially leading to arbitrary code execution or denial of service. The exploitation may also allow the attacker to access confidential data, compromise its integrity, and cause service disruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2021:4288

ALT-PU-2020-1130

ALT-PU-2020-2252

ALT-PU-2021-1392

ALT-PU-2021-3093

AZL-6637

BDU:2023-07622

CESA-2021_4288

CVE-2020-17541

OPENSUSE-SU-2021:0892-1

OPENSUSE-SU-2021:1958-1

OPENSUSE-SU-2021_0892-1

OPENSUSE-SU-2021_1958-1

RHSA-2021:4288

RHSA-2021_4288

RLSA-2021:4288

SUSE-SU-2021:1957-1

SUSE-SU-2021:1958-1

SUSE-SU-2021_1957-1

SUSE-SU-2021_1958-1

USN-5553-1

USN-5631-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Libjpeg-Turbo

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 45

• 🔥 https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392 · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1957-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1958-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1958-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-46822 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6637 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-35538 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14498 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-14152 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5631-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17541 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5553-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4288 · Vendor Advisory