CVE-2013-6629 (retired)

Priority
Description
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo
through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript,
and other products, does not check for certain duplications of component
data during the reading of segments that follow Start Of Scan (SOS) JPEG
markers, which allows remote attackers to obtain sensitive information from
uninitialized memory locations via a crafted JPEG image.
Notes
 sarnold> Michal suggests libjpeg6b will not be updated from upstream
 mdeslaur> upstream bug and proposed patch is ancient. Chromium contains
 mdeslaur> a patch.
 jdstrand> openjdk uses system jpeg
Assigned-to
mdeslaur
Package
Upstream:released (26.0)
Package
Upstream:released (7u55-2.4.7-1)
Ubuntu 14.04 ESM (Trusty Tahr):ignored (uses system libjpeg6b)
Package
Priority: Low
Upstream:released (24.2.0)
More Information

Updated: 2019-08-23 08:58:56 UTC (commit 436fd4ed4cf0038ddd382cb8649607ace163dda7)