CVE-2013-6629 Information disclosure in n/a
Remote attackers can read sensitive uninitialized memory via crafted JPEG images in libjpeg and libjpeg-turbo, affecting applications like Chrome and Ghostscript.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-6629?
CVE-2013-6629 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 15 Nov 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Weakness: CWE-200
Which versions are affected by CVE-2013-6629?
It affects 11 products.
Linux distribution packages (8)
libjpeg Red Hat:enterprise_linux:5::client | All versions | 0:6b-38 |
libjpeg-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:6b-38 |
libjpeg Red Hat:enterprise_linux:5::client_workstation | All versions | 0:6b-38 |
libjpeg-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:6b-38 |
libjpeg-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:6b-38 |
libjpeg Red Hat:enterprise_linux:5::server | All versions | 0:6b-38 |
libjpeg-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:6b-38 |
libjpeg-devel Red Hat:enterprise_linux:5::server | All versions | 0:6b-38 |
Products include Artifex Gpl Ghostscript, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Google Chrome, Libjpeg-Turbo Libjpeg-Turbo and 5 more.
How do I fix CVE-2013-6629?
Upgrade to a fixed version.
Is CVE-2013-6629 being exploited?
There is no known exploitation of CVE-2013-6629 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2013-6629, GHSA-7vr8-hqr3-rjrw, RHSA-2013:1804.