NULL pointer dereference in libjpeg-turbo - CVE-2020-35538

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU67589

NULL pointer dereference in libjpeg-turbo - CVE-2020-35538

Published: September 22, 2022


Vulnerability identifier: #VU67589
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-35538
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the jcopy_sample_rows() function. A remote attacker can pass specially crafted input to the affected application and perform a denial of service (DoS) attack.


Affected software

libjpeg-turbo
IBM Cloud Pak for Security
IBM Cloud Pak for Business Automation
QRadar Suite
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Desktop Applications
openSUSE Leap
Ubuntu
openEuler
SUSE Linux Enterprise Module for Packagehub Subpackages
libturbojpeg (Ubuntu package)
libjpeg-turbo8 (Ubuntu package)
libjpeg-turbo
libjpeg-turbo-debuginfo
libjpeg-turbo-debugsource
libjpeg62-turbo-debugsource
libjpeg62-turbo
libjpeg-turbo-devel
libjpeg-turbo-help
libjpeg8-32bit
libjpeg8
libjpeg8-debuginfo
libturbojpeg0
libturbojpeg0-debuginfo
libjpeg8-devel
libjpeg8-debuginfo-32bit
libjpeg8-32bit-debuginfo
libjpeg8-devel-32bit
libturbojpeg0-32bit
libturbojpeg0-32bit-debuginfo
libjpeg62-debuginfo-32bit
libjpeg62-32bit
libjpeg62-debuginfo
libjpeg62
libjpeg62-devel
libjpeg62-devel-32bit
libjpeg62-32bit-debuginfo
Business Automation Insights

How to mitigate CVE-2020-35538

Install update from vendor's website.

libjpeg-turbo - update to 2.0.6
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF005, 24.0.1-IF004, 25.0.0
Business Automation Insights - update to 24.0.1.0.4
libturbojpeg (Ubuntu package) - addressed in versions 1.5.2-0ubuntu5.18.04.6, 2.0.3-0ubuntu1.20.04.3
libjpeg-turbo8 (Ubuntu package) - addressed in versions 1.5.2-0ubuntu5.18.04.6, 2.0.3-0ubuntu1.20.04.3
libjpeg-turbo - addressed in versions 1.5.3-31.28.1, 1.5.3-150000.32.5.1
libjpeg-turbo-debuginfo - addressed in versions 1.5.3-31.28.1, 1.5.3-150000.32.5.1
libjpeg-turbo-debugsource - addressed in versions 1.5.3-31.28.1, 1.5.3-150000.32.5.1
libjpeg62-turbo-debugsource - addressed in versions 1.5.3-31.28.1, 1.5.3-150000.32.5.1
libjpeg62-turbo - addressed in versions 1.5.3-31.28.1, 1.5.3-150000.32.5.1
libjpeg-turbo-debuginfo - update to 2.0.5-3
libjpeg-turbo-debugsource - update to 2.0.5-3
libjpeg-turbo-devel - update to 2.0.5-3
libjpeg-turbo - update to 2.0.5-3
libjpeg-turbo-help - update to 2.0.5-3
libjpeg8-32bit - addressed in versions 8.1.2-31.28.1, 8.1.2-150000.32.5.1
libjpeg8 - addressed in versions 8.1.2-31.28.1, 8.1.2-150000.32.5.1
libjpeg8-debuginfo - addressed in versions 8.1.2-31.28.1, 8.1.2-150000.32.5.1
libturbojpeg0 - addressed in versions 8.1.2-31.28.1, 8.1.2-150000.32.5.1
libturbojpeg0-debuginfo - addressed in versions 8.1.2-31.28.1, 8.1.2-150000.32.5.1
libjpeg8-devel - addressed in versions 8.1.2-31.28.1, 8.1.2-150000.32.5.1
libjpeg8-debuginfo-32bit - update to 8.1.2-31.28.1
libjpeg8-32bit-debuginfo - update to 8.1.2-150000.32.5.1
libjpeg8-devel-32bit - update to 8.1.2-150000.32.5.1
libturbojpeg0-32bit - update to 8.1.2-150000.32.5.1
libturbojpeg0-32bit-debuginfo - update to 8.1.2-150000.32.5.1
libjpeg62-debuginfo-32bit - update to 62.2.0-31.28.1
libjpeg62-32bit - addressed in versions 62.2.0-31.28.1, 62.2.0-150000.32.5.1
libjpeg62-debuginfo - addressed in versions 62.2.0-31.28.1, 62.2.0-150000.32.5.1
libjpeg62 - addressed in versions 62.2.0-31.28.1, 62.2.0-150000.32.5.1
libjpeg62-devel - addressed in versions 62.2.0-31.28.1, 62.2.0-150000.32.5.1
libjpeg62-devel-32bit - update to 62.2.0-150000.32.5.1
libjpeg62-32bit-debuginfo - update to 62.2.0-150000.32.5.1

External References

Related Security Bulletins