CVE-2012-2845

medium

Published 2012-07-13 · Modified 2026-04-29

CVSS v3

—

CVSS v2

6.4

VIR risk

6.4

Description

Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2012-2845

OS impact

OS	Version	Status	Fixed in
debian	bookworm	fixed	`0.6.20-2`
debian	bullseye	fixed	`0.6.20-2`
debian	forky	fixed	`0.6.20-2`
debian	sid	fixed	`0.6.20-2`
debian	trixie	fixed	`0.6.20-2`

Application impact

Vendor	Product	Versions	Fixed
curtis_galloway	exif	`0.6.20`

References

http://secunia.com/advisories/49988
http://sourceforge.net/mailarchive/message.php?msg_id=29534027
http://www.mandriva.com/security/advisories?name=MDVSA-2012:107
http://www.securityfocus.com/bid/54437
https://security-tracker.debian.org/tracker/CVE-2012-2845

CWEs

CWE-189

Verify integrity in audit chain (admin only). AS-IS.