CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-13790 – Gentoo Linux Security Advisory 202010-03
https://notcve.org/view.php?id=CVE-2020-13790
03 Jun 2020 — libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file. libjpeg-turbo versión 2.0.4, y mozjpeg versión 4.0.0, presenta una lectura excesiva del búfer en la región heap de la memoria en la función get_rgb_row() en el archivo rdppm.c por medio de un archivo de entrada PPM malformado. It was discovered that libjpeg-turbo incorrectly handled certain PPM files. An attacker could possibly use this issue to access sensitive information. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 2CVE-2018-14498 – libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service
https://notcve.org/view.php?id=CVE-2018-14498
07 Mar 2019 — get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries. get_8bit_row en rdbmp.c en libjpeg-turbo, hasta la versión 1.5.90, y MozJPEG, hasta la versión 3.3.1, permite a los atacantes provocar una denegación de servicio (sobrelectura de búfer basada en memoria dinámica [he... • http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html • CWE-125: Out-of-bounds Read •