CVE Feed

    Dashboard / CVE / CVE-2020-13790

    CVE-2020-13790

    libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.

    Published:May 25, 2020
    Last Modified:Nov 21, 2024
    EPS:Jun 3, 2020
    EPSS Score:0.00547
    CVSS Score:8.1

    Affected Products

    Vendor
    Libjpeg-turbo
    Product
    Libjpeg-turbo
    Vendor
    Mozilla
    Product
    Mozjpeg
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433

    Common Weakness Enumeration

    CWE-125 Out-of-bounds Read

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-540 Overread Buffers

    Related CVEs

    CVE-2026-75466 (CVSS 6.5) — libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a va…
    CVE-2021-29390 (CVSS 7.1) — libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct…
    CVE-2023-2804 (CVSS 6.5) — A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function…
    CVE-2020-17541 (CVSS 8.8) — Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker c…
    CVE-2021-46822 (CVSS 5.5) — The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM f…
    CVE-2021-20205 (CVSS 6.5) — Libjpeg-turbo versions 2.0.91 and 2.0.90 is vulnerable to a denial of service vulnerability caused by a divide…
    CVE-2020-35538 (CVSS 5.5) — A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-t…
    CVE-2019-13960 (CVSS 5.5) — In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG …
    CVE-2018-19664 (CVSS 6.5) — libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrat…
    CVE-2018-20330 (CVSS 8.8) — The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer ove…

    References

    http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html
    https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433
    https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/
    https://security.gentoo.org/glsa/202010-03
    https://usn.ubuntu.com/4386-1/
    http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html
    https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433
    https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/
    https://security.gentoo.org/glsa/202010-03
    https://usn.ubuntu.com/4386-1/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High