libjpeg-turbo 2.0.2 JPEG Image width/height resource consumption ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as problematic, was found in libjpeg-turbo 2.0.2. This affects an unknown function of the component JPEG Image Handler. Executing a manipulation of the argument width/height can lead to resource consumption. This vulnerability is tracked as CVE-2019-13960. The attack is restricted to local execution. No exploit exists. The existence of this vulnerability is still disputed at present.

Detailsinfo

A vulnerability classified as problematic was found in libjpeg-turbo 2.0.2. This vulnerability affects some unknown functionality of the component JPEG Image Handler. The manipulation of the argument width/height with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

** DISPUTED ** In libjpeg-turbo 2.0.2, a large amount of memory can be used during processing of an invalid progressive JPEG image containing incorrect width and height values in the image header. NOTE: the vendor's expectation, for use cases in which this memory usage would be a denial of service, is that the application should interpret libjpeg warnings as fatal errors (aborting decompression) and/or set limits on resource consumption or image sizes.

The weakness was disclosed 07/18/2019. This vulnerability was named CVE-2019-13960 since 07/18/2019. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• libjpeg-turbo

Version

• 2.0.2

Website

• Product: https://github.com/libjpeg-turbo/libjpeg-turbo/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion