Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-25851 |
CWE-ID | CWE-835 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
jpeg-js Web applications / JS libraries |
Vendor | eugeneware |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU76182
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2022-25851
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when processing JPEG images. A remote attacker can consume all available system resources and cause denial of service conditions.
MitigationInstall updates from vendor's website.
Vulnerable software versionsjpeg-js: 0.0.1 - 0.4.3
Fixed software versionsCPE2.3 External links
http://snyk.io/vuln/SNYK-JS-JPEGJS-2859218
http://github.com/jpeg-js/jpeg-js/issues/105
http://github.com/jpeg-js/jpeg-js/pull/106/
http://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27
http://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2860295
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?