PT-2020-3024 · Ijg+1 · Libjpeg+1

Dongdong She + 1 · Published 2020-06-15 · Updated 2024-07-16 · CVE-2020-14152

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions IJG JPEG (aka libjpeg) versions prior to 9d

Description The issue is related to the jpeg mem available() function in jmemnobs.c in djpeg, which does not honor the max memory to use setting, possibly causing excessive memory consumption. This could allow a remote attacker to disclose protected information or cause a denial of service.

Recommendations For versions prior to 9d, update to version 9d or later to resolve the issue. As a temporary workaround, consider restricting the use of the jpeg mem available() function in djpeg to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-45315

BDU:2020-03268

CVE-2020-14152

DLA-2302-1

GHSA-G4M4-9Q4C-MFW6

USN-5336-1

USN-5497-1

USN-5497-2

USN-5553-1

Affected Products

Ubuntu

Libjpeg

References · 41

• https://ubuntu.com/security/CVE-2018-11212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14152 · Security Note
• https://ubuntu.com/security/notices/USN-5336-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-11813 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-17541 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14152 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3616 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5553-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4m4-9q4c-mfw6 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2302-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5497-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5497-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14498 · Vendor Advisory