CVE-2013-6629

Name of the Vulnerable Software and Affected Versions libjpeg versions 6b libjpeg-turbo versions 1.2.1 through 1.3.0

Description The issue is related to the handling of JPEG images, which can lead to the disclosure of sensitive information from uninitialized memory locations. This can be exploited remotely. The get sos function in jdmarker.c does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers. An information disclosure vulnerability exists within the open-source libjpeg image-processing library where it fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization (ASLR) bypass.

Recommendations For libjpeg version 6b, update to a version that fixes the vulnerability. For libjpeg-turbo versions 1.2.1 through 1.3.0, update to a version that fixes the vulnerability. As a temporary workaround, consider disabling the handling of JPEG images until a patch is available. Restrict access to the vulnerable library to minimize the risk of exploitation.