Vulnerability CVE-2013-6629: Information

Description

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

Severity: MEDIUM (5.0)

URL: https://nvd.nist.gov/vuln/detail/CVE-2013-6629
Published: Nov. 19, 2013
Modified: June 21, 2023
Error type identifier: CWE-200

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
chromiumsisyphus31.0.1650.57-alt1.r235101124.0.6367.207-alt1ALT-PU-2013-1119-1108603Fixed
chromiump1031.0.1650.57-alt1.r235101119.0.6045.159-alt0.p10.1ALT-PU-2013-1119-1108603Fixed
chromiump931.0.1650.57-alt1.r23510197.0.4692.99-alt0.p9.1ALT-PU-2013-1119-1108603Fixed
chromiumc10f131.0.1650.57-alt1.r235101110.0.5481.177-alt1.p10.1ALT-PU-2013-1119-1108603Fixed
chromiumc9f231.0.1650.57-alt1.r23510184.0.4147.105-alt1.1.p9ALT-PU-2013-1119-1108603Fixed
chromiumc732.0.1700.102-alt0.M70P.138.0.2125.122-alt0.M70C.2ALT-PU-2014-1140-1113152Fixed
firefoxsisyphus26.0-alt1125.0.3-alt1ALT-PU-2013-1333-1111073Fixed
firefoxp1026.0-alt1118.0.2-alt0.p10.1ALT-PU-2013-1333-1111073Fixed
firefoxp926.0-alt1105.0.1-alt0.c9.1ALT-PU-2013-1333-1111073Fixed
firefoxc10f126.0-alt1112.0.2-alt0.p10.1ALT-PU-2013-1333-1111073Fixed
firefoxc9f226.0-alt1105.0.1-alt0.c9.1ALT-PU-2013-1333-1111073Fixed
firefoxc731.3.0-alt0.M70C.260.8.0-alt0.M70C.1ALT-PU-2015-1094-1139024Fixed
libjpeg-turbosisyphus1.3.1-alt0.13.0.2-alt2.1ALT-PU-2013-1324-1111060Fixed
libjpeg-turbop101.3.1-alt0.12.1.5.1-alt1.p10.2ALT-PU-2013-1324-1111060Fixed
libjpeg-turbop91.3.1-alt0.12.0.2-alt1ALT-PU-2013-1324-1111060Fixed
libjpeg-turboc10f11.3.1-alt0.12.1.2-alt1.2ALT-PU-2013-1324-1111060Fixed
libjpeg-turboc9f21.3.1-alt0.12.0.2-alt1.c9f2.1ALT-PU-2013-1324-1111060Fixed
seamonkeyp92.23-alt12.53.14-alt1ALT-PU-2014-1201-1114634Fixed
seamonkeyc10f12.23-alt12.53.14-alt1ALT-PU-2014-1201-1114634Fixed
seamonkeyc9f22.23-alt12.53.14-alt1ALT-PU-2014-1201-1114634Fixed
seamonkeyc72.23-alt0.M70P.12.26-alt0.M70P.1ALT-PU-2014-1372-1117117Fixed
thunderbirdsisyphus24.2.0-alt1115.9.0-alt1ALT-PU-2013-1334-1111073Fixed
thunderbirdp1024.2.0-alt1115.9.0-alt1ALT-PU-2013-1334-1111073Fixed
thunderbirdp924.2.0-alt1102.11.0-alt0.c9.1ALT-PU-2013-1334-1111073Fixed
thunderbirdc10f124.2.0-alt1115.9.0-alt0.c10.1ALT-PU-2013-1334-1111073Fixed
thunderbirdc9f224.2.0-alt1102.11.0-alt0.c9.1ALT-PU-2013-1334-1111073Fixed
thunderbirdc724.3.0-alt0.M70P.160.8.0-alt0.M70C.1ALT-PU-2014-1391-1117167Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://code.google.com/p/chromium/issues/detail?id=258723
  • Issue Tracking
  • Third Party Advisory
https://src.chromium.org/viewvc/chrome?revision=229729&view=revision
  • Patch
  • Third Party Advisory
20131112 bugs in IJG jpeg6b & libjpeg-turbo
  • Broken Link
http://bugs.ghostscript.com/show_bug.cgi?id=686980
  • Issue Tracking
  • Vendor Advisory
http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
  • Vendor Advisory
http://www.mozilla.org/security/announce/2013/mfsa2013-116.html
  • Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=891693
  • Issue Tracking
  • Patch
  • Third Party Advisory
DSA-2799
  • Third Party Advisory
RHSA-2013:1803
  • Third Party Advisory
openSUSE-SU-2013:1776
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2013:1861
  • Mailing List
  • Third Party Advisory
RHSA-2013:1804
  • Third Party Advisory
USN-2053-1
  • Third Party Advisory
USN-2052-1
  • Third Party Advisory
openSUSE-SU-2013:1777
  • Mailing List
  • Third Party Advisory
FEDORA-2013-23127
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2013:1957
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2013:1959
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2013:1958
  • Mailing List
  • Third Party Advisory
56175
  • Not Applicable
openSUSE-SU-2014:0008
  • Mailing List
  • Third Party Advisory
FEDORA-2013-23295
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2013:1917
  • Mailing List
  • Third Party Advisory
USN-2060-1
  • Third Party Advisory
openSUSE-SU-2013:1916
  • Mailing List
  • Third Party Advisory
FEDORA-2013-23291
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2013:1918
  • Mailing List
  • Third Party Advisory
FEDORA-2013-23519
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2014:0065
  • Mailing List
  • Third Party Advisory
http://support.apple.com/kb/HT6150
  • Third Party Advisory
MDVSA-2013:273
  • Broken Link
http://advisories.mageia.org/MGASA-2013-0333.html
  • Third Party Advisory
http://support.apple.com/kb/HT6163
  • Third Party Advisory
http://support.apple.com/kb/HT6162
  • Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
  • Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21672080
  • Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21676746
  • Broken Link
58974
  • Not Applicable
59058
  • Not Applicable
https://www.ibm.com/support/docview.wss?uid=swg21675973
  • Third Party Advisory
GLSA-201406-32
  • Third Party Advisory
1029476
  • Broken Link
  • Third Party Advisory
  • VDB Entry
1029470
  • Broken Link
  • Third Party Advisory
  • VDB Entry
GLSA-201606-03
  • Third Party Advisory
SSRT101668
  • Issue Tracking
  • Mailing List
  • Third Party Advisory
SSRT101667
  • Issue Tracking
  • Mailing List
  • Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
  • Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
  • Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629
  • Patch
  • Third Party Advisory
63676
  • Broken Link
  • Third Party Advisory
  • VDB Entry
RHSA-2014:0414
  • Third Party Advisory
RHSA-2014:0413
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
      End excliding
      31.0.1650.48

      Configuration 2

      cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:a:artifex:gpl_ghostscript:*:*:*:*:*:*:*:*
      End excliding
      9.03

      Configuration 4

      cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:*:*:*:*:*:*:*:*
      End excliding
      1.3.1

      Configuration 5

      cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*
      cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
      cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*

      Configuration 6

      cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
      cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
      cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

      Configuration 7

      cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

      Configuration 8

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

      Configuration 9

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      26.0
      cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
      End excliding
      2.23
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      24.2.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      24.2
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.0
Back to top