Libjpeg-turbo

This hub aggregates every CVE we track for Libjpeg-turbo, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Libjpeg-turbo.

• CVE-2021-29390libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.7.1Aug 22, 2023
• CVE-2023-2804A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision...6.5May 25, 2023
• CVE-2020-35538A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.5.5Aug 31, 2022
• CVE-2021-46822The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. Th...5.5Jun 18, 2022
• BDU:2021-05120Уязвимость функции tjInitDecompress() библиотеки для работы с изображениями libjpeg-turbo, позволяющая нарушителю оказать воздействие на доступность защищаемой информации3.7Oct 27, 2021
• BDU:2021-05119Уязвимость функций alloc_large() и alloc_sarray() библиотеки для работы с изображениями libjpeg-turbo, позволяющая нарушителю вызвать операцию деления на ноль3.7Oct 27, 2021
• BDU:2021-05122Уязвимость функции decode_mcu() библиотеки для работы с изображениями libjpeg-turbo, позволяющая нарушителю оказать воздействие на доступность защищаемой информации5.3Oct 27, 2021
• BDU:2021-05123Уязвимость библиотеки для работы с изображениями libjpeg-turbo, позволяющая нарушителю оказать воздействие на доступность защищаемой информации3.7Oct 27, 2021
• BDU:2021-05121Уязвимость функций decode_mcu() и decode_mcu_fast() библиотеки для работы с изображениями libjpeg-turbo, позволяющая нарушителю вызвать отказ в обслуживании5.9Oct 27, 2021
• CVE-2021-37972Out of bounds read in libjpeg-turbo in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.8.8Oct 8, 2021
• CVE-2020-17541Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or deni...8.8Jun 1, 2021
• CVE-2021-20205Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted GIF image.6.5Mar 10, 2021
• CVE-2020-13790libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.8.1Jun 3, 2020
• CVE-2019-2201In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged proc...7.8Nov 13, 2019
• CVE-2019-13960In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendo...5.5Jul 18, 2019