Unscored severity · published Nov 19, 2013
CVE-2013-6629
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not…
–
CVSS
9.7%
EPSS
No
On KEV
Description
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
before 31.0.1650.48 · source: NVD
FI
Firefox · Mozilla
before 24.2; before 26.0 · source: NVD
DL
Debian Linux · Debian
7.0; 8.0 · source: NVD
FE
Fedora · Fedoraproject
18; 19; 20 · source: NVD
GG
Gpl Ghostscript · Artifex
before 9.03 · source: NVD
LI
Libjpeg-turbo · Libjpeg-turbo
before 1.3.1 · source: NVD
OP
Opensuse · Opensuse
12.2; 12.3; 13.1 · source: NVD
SE
Seamonkey · Mozilla
before 2.23 · source: NVD
SO
Solaris · Oracle
11.3 · source: NVD
TH
Thunderbird · Mozilla
before 24.2.0 · source: NVD
UL
Ubuntu Linux · Canonical
10.04; 12.04; 12.10; 13.04; 13.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6629
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6629
Third Party Advisory
http://advisories.mageia.org/MGASA-2013-0333.html
Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html
Issue Tracking
http://bugs.ghostscript.com/show_bug.cgi?id=686980
Vendor Advisory
http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability