CVE-2022-31796

libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be different between allocation and use.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 56.95%
Affected Products (NVD)
VendorProductVersion
jpeglibjpeg
1.63
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libjpeg
bookworm
0.0~git20220805.54ec643-1
fixed
bullseye
unimportant
sid
0.0~git20220805.54ec643-1
fixed
trixie
0.0~git20220805.54ec643-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libjpeg
focal
needed
impish
ignored
jammy
needed
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needed
oracular
ignored
plucky
ignored
questing
ignored
resolute
needed
libjpeg-turbo
bionic
not-affected
focal
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
not-affected
xenial
not-affected
libjpeg6b
bionic
not-affected
focal
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
not-affected
xenial
not-affected
libjpeg9
bionic
not-affected
focal
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
resolute
not-affected
trusty
dne
xenial
not-affected