CVE-2013-6630
medium
CVSS v3
—
CVSS v4 NEW
—
VIR risk
5.0
Description
The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 1.3.0-3 |
| debian | bullseye | fixed | 1.3.0-3 |
| debian | forky | fixed | 1.3.0-3 |
| debian | sid | fixed | 1.3.0-3 |
| debian | trixie | fixed | 1.3.0-3 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| chrome | {"endIncluding":"31.0.1650.47"} | | |
| chrome | 31.0.1650.0 | | |
| chrome | 31.0.1650.2 | | |
| chrome | 31.0.1650.3 | | |
| chrome | 31.0.1650.4 | | |
| chrome | 31.0.1650.5 | | |
| chrome | 31.0.1650.6 | | |
| chrome | 31.0.1650.7 | | |
| chrome | 31.0.1650.8 | | |
| chrome | 31.0.1650.9 | | |
| chrome | 31.0.1650.10 | | |
| chrome | 31.0.1650.11 | | |
| chrome | 31.0.1650.12 | | |
| chrome | 31.0.1650.13 | | |
| chrome | 31.0.1650.14 | | |
| chrome | 31.0.1650.15 | | |
| chrome | 31.0.1650.16 | | |
| chrome | 31.0.1650.17 | | |
| chrome | 31.0.1650.18 | | |
| chrome | 31.0.1650.19 | | |
| chrome | 31.0.1650.20 | | |
| chrome | 31.0.1650.22 | | |
| chrome | 31.0.1650.23 | | |
| chrome | 31.0.1650.25 | | |
| chrome | 31.0.1650.26 | | |
| chrome | 31.0.1650.27 | | |
| chrome | 31.0.1650.28 | | |
| chrome | 31.0.1650.29 | | |
| chrome | 31.0.1650.30 | | |
| chrome | 31.0.1650.31 | | |
| chrome | 31.0.1650.32 | | |
| chrome | 31.0.1650.33 | | |
| chrome | 31.0.1650.34 | | |
| chrome | 31.0.1650.35 | | |
| chrome | 31.0.1650.36 | | |
| chrome | 31.0.1650.37 | | |
| chrome | 31.0.1650.38 | | |
| chrome | 31.0.1650.39 | | |
| chrome | 31.0.1650.41 | | |
| chrome | 31.0.1650.42 | | |
| chrome | 31.0.1650.43 | | |
| chrome | 31.0.1650.44 | | |
| chrome | 31.0.1650.45 | | |
| chrome | 31.0.1650.46 | |
References
- http://advisories.mageia.org/MGASA-2013-0333.html
- http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html
- http://git.chromium.org/gitweb/?p=chromium/deps/libjpeg_turbo.git%3Ba=commit%3Bh=32cab49bd4cb1ce069a435fd75f9439c34ddc6f8
- http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2013-1803.html
- http://secunia.com/advisories/56175
- http://www.debian.org/security/2013/dsa-2799
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:273
- http://www.mozilla.org/security/announce/2013/mfsa2013-116.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
CWEs
CWE-189
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.