Log in Start free

Vulnerability · Published Jun 3, 2020 · Assigned by mitre

CVE-2020-13790

High 8.1

In plain English

A high-severity security flaw in the libjpeg-turbo package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.1High
Exploit odds (30 days)3.2%top 11.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libjpeg-turbo1.5.3-14.el8_10ALSA-2025:7540
AlmaLinux:8libjpeg-turbo-devel1.5.3-14.el8_10ALSA-2025:7540
AlmaLinux:8libjpeg-turbo-utils1.5.3-14.el8_10ALSA-2025:7540
AlmaLinux:8turbojpeg1.5.3-14.el8_10ALSA-2025:7540
AlmaLinux:8turbojpeg-devel1.5.3-14.el8_10ALSA-2025:7540
Alpine:v3.20libjpeg-turbo2.0.4-r2ALPINE-CVE-2020-13790
Alpine:v3.21libjpeg-turbo2.0.4-r2ALPINE-CVE-2020-13790
Alpine:v3.22libjpeg-turbo2.0.4-r2ALPINE-CVE-2020-13790
Alpine:v3.23libjpeg-turbo2.0.4-r2ALPINE-CVE-2020-13790
Alpine:v3.24libjpeg-turbo2.0.4-r2ALPINE-CVE-2020-13790
Debian:12libjpeg-turbo1:2.0.5-1DEBIAN-CVE-2020-13790
Debian:13libjpeg-turbo1:2.0.5-1DEBIAN-CVE-2020-13790
Debian:14libjpeg-turbo1:2.0.5-1DEBIAN-CVE-2020-13790
Rocky Linux:8libjpeg-turbo0:1.5.3-14.el8_10RLSA-2025:7540

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References