CVE-2020-13790 — Out-of-bounds Read in Libjpeg-turbo

CWE-125 — Out-of-bounds Read11 documents8 sources
Severity
8.1HIGHNVD
EPSS
0.5%
top 34.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libjpeg-turboDebian Libjpeg-turboMozilla Mozjpeg
Timeline
PublishedJun 3
Latest updateJun 30

Description

libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages4 packages

▶debiandebian/libjpeg-turbo< libjpeg-turbo 1:2.0.5-1 (bookworm)
▶Debianlibjpeg-turbo/libjpeg-turbo< 1:2.0.5-1+3
▶NVDmozilla/mozjpeg4.0.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-3rgw-2fpg-85mq: libjpeg-turbo 2↗2022-05-24
▶
OSV
CVE-2020-13790: libjpeg-turbo 2↗2020-06-03
▶

📋Vendor Advisories

3
Ubuntu
libjpeg-turbo vulnerability↗2020-06-09
▶
Red Hat
libjpeg-turbo: heap-based buffer over-read in get_rgb_row() in rdppm.c↗2020-05-25
▶
Debian
CVE-2020-13790: libjpeg-turbo - libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get...↗2020
▶

📄Research Papers

2
arXiv
Fuzzing: Randomness? Reasoning! Efficient Directed Fuzzing via Large Language Models↗2025-06-30
▶
arXiv
Directed Greybox Fuzzing via Large Language Model↗2025-05-06
▶

💬Community

3
Bugzilla
CVE-2020-13790 libjpeg-turbo: heap-based buffer over-read in get_rgb_row() in rdppm.c↗2020-06-15
▶
Bugzilla
CVE-2020-13790 mingw-libjpeg-turbo: libjpeg-turbo: heap-based buffer over-read in get_rgb_row() in rdppm.c [fedora-all]↗2020-06-15
▶
Bugzilla
CVE-2020-13790 libjpeg-turbo: heap-based buffer over-read in get_rgb_row() in rdppm.c [fedora-all]↗2020-06-15
▶