CVE-2013-6629 (retired)

Priority
Description
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo
through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript,
and other products, does not check for certain duplications of component
data during the reading of segments that follow Start Of Scan (SOS) JPEG
markers, which allows remote attackers to obtain sensitive information from
uninitialized memory locations via a crafted JPEG image.
Notes
 sarnold> Michal suggests libjpeg6b will not be updated from upstream
 mdeslaur> upstream bug and proposed patch is ancient. Chromium contains
 mdeslaur> a patch.
 jdstrand> openjdk uses system jpeg
Assigned-to
mdeslaur
Package
Upstream:released (26.0)
Ubuntu 14.04 LTS (Trusty Tahr):not-affected
Package
Upstream:released (7u55-2.4.7-1)
Ubuntu 14.04 LTS (Trusty Tahr):ignored (uses system libjpeg6b)
Package
Priority: Low
Upstream:released (24.2.0)
Ubuntu 14.04 LTS (Trusty Tahr):released (1:24.2.0+build1-0ubuntu1)
More Information

Updated: 2019-03-26 12:11:15 UTC (commit ccdecfcf0fead22bd291e5f4ea745a46872dcb15)