CVE-2006-1060

HIGH 7.5CVE-2006-1060 · Published 11/04/2006 · updated 16/06/2026

In short

CVE-2006-1060 is a HIGH (CVSS 7.5) vulnerability affecting xzgv (xzgv).
Chance of exploitation in the next 30 days (EPSS): 4.2%, higher than 91.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
xzgv xzgv	`≤ 0.8`	No fix yet

Description

Heap-based buffer overflow in zgv before 5.8 and xzgv before 0.8 might allow user-assisted attackers to execute arbitrary code via a JPEG image with more than 3 output components, such as a CMYK or YCCK color space, which causes less memory to be allocated than required.

References

secunia.com/advisories/19571 · Vendor Advisory
secunia.com/advisories/19572 · Vendor Advisory
secunia.com/advisories/19731 · Vendor Advisory
secunia.com/advisories/19757 · Patch
secunia.com/advisories/19779 · Patch
secunia.com/advisories/19790 · Vendor Advisory
securityreason.com/securityalert/756
debian.org/security/2006/dsa-1037
debian.org/security/2006/dsa-1038
novell.com/linux/security/advisories/2006_08_sr.html
securityfocus.com/bid/17409
vupen.com/english/advisories/2006/1288 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/25718

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free