CVE-2020-13790

概要

参考情報

• lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html
• lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html
• libjpeg-turbo/libjpeg-turbo commit 3de15e0 · Patch
• libjpeg-turbo/libjpeg-turbo · Exploit
• lists.debian.org/debian-lts-announce/2020/07/msg00033.html
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK
• security.gentoo.org/glsa/202010-03
• usn.ubuntu.com/4386-1

libjpeg-turbo のその他の脆弱性

• CVE-2021-29390高 7.1libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
• CVE-2023-2804中 6.5A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulne…
• CVE-2020-35538中 5.5A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.
• CVE-2021-46822中 5.5The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer an…
• CVE-2020-17541高 8.8Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file …