CVE-2021-29390

libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.1 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
Affected Products (NVD)
VendorProductVersion
libjpeg-turbolibjpeg-turbo
2.0.90
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libjpeg-turbo
bookworm
1:2.1.5-2
fixed
bullseye
1:2.0.6-4
fixed
sid
1:2.1.5-3
fixed
trixie
1:2.1.5-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libjpeg-turbo
bionic
not-affected
focal
not-affected
jammy
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
not-affected
xenial
not-affected
libjpeg6b
bionic
not-affected
focal
not-affected
jammy
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
not-affected
xenial
not-affected
libjpeg9
bionic
not-affected
focal
not-affected
jammy
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libjpeg-turbo
RHEL 9
0:2.0.90-7.el9
fixed
libjpeg-turbo-devel
RHEL 9
0:2.0.90-7.el9
fixed
libjpeg-turbo-utils
RHEL 9
0:2.0.90-7.el9
fixed
turbojpeg
RHEL 9
0:2.0.90-7.el9
fixed
turbojpeg-devel
RHEL 9
0:2.0.90-7.el9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
libjpeg-turbo
Amazon Linux 2
0:2.0.90-2.amzn2.0.6
fixed
libjpeg-turbo-debuginfo
Amazon Linux 2
0:2.0.90-2.amzn2.0.6
fixed
libjpeg-turbo-devel
Amazon Linux 2
0:2.0.90-2.amzn2.0.6
fixed
libjpeg-turbo-utils
Amazon Linux 2
0:2.0.90-2.amzn2.0.6
fixed
turbojpeg
Amazon Linux 2
0:2.0.90-2.amzn2.0.6
fixed
turbojpeg-devel
Amazon Linux 2
0:2.0.90-2.amzn2.0.6
fixed
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1943797
https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595
https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
https://bugzilla.redhat.com/show_bug.cgi?id=1943797
https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595
https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/