Patchwire CVEs, their patch status, and feeds to follow them

CVE-2018-19664

Fixed in a distro release EPSS 2%

libjpeg-turbo 2.0.1 has a heap-based buffer over-read in the put_pixel_rows function in wrbmp.c, as demonstrated by djpeg.

Published 2018-11-29 · CVE record · OSV

Products: libjpeg-turbo

Distro releases

ReleasePackageFixed in
Alpine 3.10libjpeg-turbo2.0.2-r0
Alpine 3.11libjpeg-turbo2.0.2-r0
Alpine 3.12libjpeg-turbo2.0.2-r0
Alpine 3.13libjpeg-turbo2.0.2-r0
Alpine 3.14libjpeg-turbo2.0.2-r0
Alpine 3.15libjpeg-turbo2.0.2-r0
Alpine 3.16libjpeg-turbo2.0.2-r0
Alpine 3.17libjpeg-turbo2.0.2-r0
Alpine 3.18libjpeg-turbo2.0.2-r0
Alpine 3.19libjpeg-turbo2.0.2-r0
Alpine 3.20libjpeg-turbo2.0.2-r0
Alpine 3.21libjpeg-turbo2.0.2-r0
Alpine 3.22libjpeg-turbo2.0.2-r0
Alpine 3.23libjpeg-turbo2.0.2-r0
Alpine 3.24libjpeg-turbo2.0.2-r0
Ubuntu 16.04 LTSlibjpeg-turbo1.4.2-0ubuntu3.3
Ubuntu 18.04 LTSlibjpeg-turbo1.5.2-0ubuntu5.18.04.3
openSUSE Tumbleweedlibjpeg-turbo8.2.2-65.2