PatchTheCVEjpeg vulnerabilities
Recent CVEs affecting jpeg products. 16 tracked.
jpeg has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2023-07-13. Highest priority: CVE-2022-37768 (score 53/100).
- CVE-2023-37837 MEDIUM 6.5 UPGRADE libjpeg commit db33a6e was discovered to contain a heap buffer overflow via LineBitmapRequester::EncodeRegion
- CVE-2023-37836 MEDIUM 6.5 UPGRADE libjpeg commit db33a6e was discovered to contain a reachable assertion via BitMapHook::BitMapHook at bitmaphoo
- CVE-2022-37770 MEDIUM 6.5 MITIGATE libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at li
- CVE-2022-37769 MEDIUM 6.5 MITIGATE libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecode
- CVE-2022-37768 HIGH 7.5 MITIGATE libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer.
- CVE-2022-35166 MEDIUM 5.5 DOWNGRADE libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.
- CVE-2022-32978 MEDIUM 6.5 UPGRADE There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg befor
- CVE-2022-31796 MEDIUM 6.5 DOWNGRADE libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitm
- CVE-2021-39520 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-39519 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-39518 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-39517 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-39516 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-39515 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-39514 MEDIUM 6.5 UPGRADE An issue was discovered in libjpeg through 2020021
- CVE-2021-28026 HIGH 7.8 DOWNGRADE jpeg-xl v0.3.2 is affected by a heap buffer overflow in /lib/jxl/coeff_order.cc ReadPermutation
FAQ
How do I fix jpeg vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is jpeg being exploited right now?
None of the tracked jpeg CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which jpeg CVE should I patch first?
CVE-2022-37768 currently ranks highest (53/100): libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer..