CVE-2019-13960: Medium severity libjpeg-turbo-devel vulnerability
DISPUTED In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation, for use cases in which this memory usage would be a denial of service, is that the application should interpret libjpeg warnings as fatal errors (aborting decompression) and/or set limits on resource consumption or image sizes.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-13960?
CVE-2019-13960 is a vulnerability in libjpeg-turbo 2.0.2 that allows a large amount of memory usage during processing of an invalid progressive JPEG image.
What is the severity of CVE-2019-13960?
The severity of CVE-2019-13960 is medium, with a severity value of 5.5.
How does CVE-2019-13960 affect libjpeg-turbo?
CVE-2019-13960 affects libjpeg-turbo 2.0.2 by causing excessive memory usage when processing an invalid progressive JPEG image.
What is the fix for CVE-2019-13960?
There is currently no fix available for CVE-2019-13960. It is recommended to follow the vendor's updates and patches for any future fix.
Where can I find more information about CVE-2019-13960?
You can find more information about CVE-2019-13960 at the following references: [Reference 1](https://github.com/libjpeg-turbo/libjpeg-turbo/issues/337) and [Reference 2](https://libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf).