CVE-2020-14153: High severity suse libjpeg8 vulnerability
In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14153?
CVE-2020-14153 is a vulnerability in IJG JPEG (aka libjpeg) that allows an out-of-bounds array read for certain table pointers.
How severe is CVE-2020-14153?
CVE-2020-14153 has a severity rating of 7.1, which is considered high.
What software is affected by CVE-2020-14153?
The affected software includes libjpeg-turbo versions 1.5.2-2+deb10u1, 2.0.6-4, and 2.1.5-2 (from debian), libjpeg9 version 1:9e-1 (from debian), libjpeg9 version 1:9 (from ubuntu xenial), and libjpeg9 version 9 (upstream ubuntu).
How can I fix CVE-2020-14153?
To fix CVE-2020-14153, update the libjpeg-turbo or libjpeg9 packages to the recommended versions: 1.5.2-2+deb10u1, 2.0.6-4, 2.1.5-2 (from debian) or 1:9e-1 (from debian) or 1:9 (from ubuntu xenial) or 9 (upstream ubuntu).
Where can I find more information about CVE-2020-14153?
You can find more information about CVE-2020-14153 in the following references: http://www.ijg.org/files/jpegsrc.v9d.tar.gz, https://bugs.gentoo.org/727908, https://github.com/libjpeg-turbo/libjpeg-turbo/issues/445.