Multiple vulnerabilities in libjpeg-turbo



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2020-17541
CWE-ID CWE-119
CWE-787
CWE-190
CWE-121
Exploitation vector Network
Public exploit N/A
Vulnerable software
 libjpeg-turbo
Client/Desktop applications / Multimedia software

Vendor The libjpeg-turbo Project

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU23853

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when attempting to decompress JPEG images with unusual sampling factors as 4:4:4 JPEG images using tjDecompressToYUV2() or tjDecompressToYUVPlanes(). A remote attacker can create a specially crafted JPEG file, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

libjpeg-turbo: 2.0.2 - 2.0.3

CPE2.3 External links

http://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU23852

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within tjDecompressToYUV2() and tjDecompressToYUVPlanes() functions when attempting to decompress grayscale JPEG images that were compressed with a sampling factor other than 1. A remote attacker can create a specially crafted JPEG file, pass it to the affected application, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

libjpeg-turbo: 2.0.0 - 2.0.3

CPE2.3 External links

http://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU23851

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a signed integer overflow when attempting to decompress images with more than 715827882 pixels using the 64-bit C version of TJBench. A remote attacker can pass a specially crafted image to the application, trigger integer overflow and perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

libjpeg-turbo: 2.0.0 - 2.0.3

CPE2.3 External links

http://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stack-based buffer overflow

EUVDB-ID: #VU54089

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17541

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the in the "transform" component in Libjpeg-turb. A remote attacker can create a specially crafted JPEG image, pass it to the affected aplication, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

libjpeg-turbo: 1.4.0 - 2.0.3

CPE2.3 External links

http://github.com/libjpeg-turbo/libjpeg-turbo/issues/392
http://github.com/libjpeg-turbo/libjpeg-turbo/releases/tag/2.0.4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###