Published: 19/11/2013 Updated: 21/06/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo up to and including 1.3.0, as used in Google Chrome prior to 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote malicious users to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
google chrome
oracle solaris 11.3
artifex gpl ghostscript
libjpeg-turbo libjpeg-turbo
fedoraproject fedora 18
fedoraproject fedora 20
fedoraproject fedora 19
opensuse opensuse 12.3
opensuse opensuse 12.2
opensuse opensuse 13.1
canonical ubuntu linux 13.04
canonical ubuntu linux 13.10
canonical ubuntu linux 12.10
canonical ubuntu linux 10.04
canonical ubuntu linux 12.04
debian debian linux 8.0
debian debian linux 7.0
mozilla firefox
mozilla seamonkey
mozilla thunderbird
mozilla firefox esr

Debian Bug report logs - #729867 libjpeg8: CVE-2013-6629 Package: libjpeg8; Maintainer for libjpeg8 is (unknown); Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Mon, 18 Nov 2013 12:48:02 UTC Severity: important Tags: patch, security Fixed in version libjpeg8/8d-2 Done: Bill Allombert <ballombe@debianorg> ...

Synopsis Moderate: libjpeg-turbo security update Type/Severity Security Advisory: Moderate Topic Updated libjpeg-turbo packages that fix two security issues are nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vuln ...

Synopsis Moderate: libjpeg security update Type/Severity Security Advisory: Moderate Topic An updated libjpeg package that fixes one security issue is now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerabilit ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Several security issues were fixed in Thunderbird ...

libjpeg and libjpeg-turbo could be made to expose sensitive information ...

Several vulnerabilities have been discovered in the chromium web browser CVE-2013-2931 The chrome 31 development team found various issues from internal fuzzing, audits, and other studies CVE-2013-6621 Khalil Zhani discovered a use-after-free issue in speech input handling CVE-2013-6622 cloudfuzzer discovered a use-after-fre ...

An uninitialized memory read issue was found in the way libjpeg-turbo decoded images with missing Start Of Scan (SOS) JPEG markers or Define Huffman Table (DHT) JPEG markers A remote attacker could create a specially crafted JPEG image that, when decoded, could possibly lead to a disclosure of potentially sensitive information (CVE-2013-6629, CVE ...

Mozilla Foundation Security Advisory 2013-116 JPEG information leak Announced December 10, 2013 Reporter Michal Zalewski Impact High Products Firefox, Firefox ESR, SeaMonkey, Thunderbird Fixed in ...

CWE-200 https://code.google.com/p/chromium/issues/detail?id=258723 https://src.chromium.org/viewvc/chrome?revision=229729&view=revision http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html http://bugs.ghostscript.com/show_bug.cgi?id=686980 http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html http://www.mozilla.org/security/announce/2013/mfsa2013-116.html https://bugzilla.mozilla.org/show_bug.cgi?id=891693 http://www.debian.org/security/2013/dsa-2799 http://rhn.redhat.com/errata/RHSA-2013-1803.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html http://rhn.redhat.com/errata/RHSA-2013-1804.html http://www.ubuntu.com/usn/USN-2053-1 http://www.ubuntu.com/usn/USN-2052-1 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html http://secunia.com/advisories/56175 http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html http://www.ubuntu.com/usn/USN-2060-1 http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html http://support.apple.com/kb/HT6150 http://www.mandriva.com/security/advisories?name=MDVSA-2013:273 http://advisories.mageia.org/MGASA-2013-0333.html http://support.apple.com/kb/HT6163 http://support.apple.com/kb/HT6162 http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html http://www-01.ibm.com/support/docview.wss?uid=swg21672080 http://www-01.ibm.com/support/docview.wss?uid=swg21676746 http://secunia.com/advisories/58974 http://secunia.com/advisories/59058 https://www.ibm.com/support/docview.wss?uid=swg21675973 http://security.gentoo.org/glsa/glsa-201406-32.xml http://www.securitytracker.com/id/1029476 http://www.securitytracker.com/id/1029470 https://security.gentoo.org/glsa/201606-03 http://marc.info/?l=bugtraq&m=140852974709252&w=2 http://marc.info/?l=bugtraq&m=140852886808946&w=2 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629 http://www.securityfocus.com/bid/63676 https://access.redhat.com/errata/RHSA-2014:0414 https://access.redhat.com/errata/RHSA-2014:0413 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729867 https://nvd.nist.gov https://usn.ubuntu.com/2052-1/

CVE-2013-6629

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect