Patchwire CVEs, their patch status, and feeds to follow them

CVE-2018-20330

Fixed in a distro release EPSS 2%

The tjLoadImage function in libjpeg-turbo 2.0.1 has an integer overflow with a resultant heap-based buffer overflow via a BMP image because multiplication of pitch and height is mishandled, as demonstrated by tjbench.

Published 2018-12-21 · CVE record · OSV

Products: libjpeg-turbo

Distro releases

ReleasePackageFixed in
Alpine 3.10libjpeg-turbo2.0.2-r0
Alpine 3.11libjpeg-turbo2.0.2-r0
Alpine 3.12libjpeg-turbo2.0.2-r0
Alpine 3.13libjpeg-turbo2.0.2-r0
Alpine 3.14libjpeg-turbo2.0.2-r0
Alpine 3.15libjpeg-turbo2.0.2-r0
Alpine 3.16libjpeg-turbo2.0.2-r0
Alpine 3.17libjpeg-turbo2.0.2-r0
Alpine 3.18libjpeg-turbo2.0.2-r0
Alpine 3.19libjpeg-turbo2.0.2-r0
Alpine 3.20libjpeg-turbo2.0.2-r0
Alpine 3.21libjpeg-turbo2.0.2-r0
Alpine 3.22libjpeg-turbo2.0.2-r0
Alpine 3.23libjpeg-turbo2.0.2-r0
Alpine 3.24libjpeg-turbo2.0.2-r0
Ubuntu 16.04 LTSlibjpeg-turbo1.4.2-0ubuntu3.3
Ubuntu 18.04 LTSlibjpeg-turbo1.5.2-0ubuntu5.18.04.3
openSUSE Tumbleweedlibjpeg-turbo8.2.2-65.2