CVE-2023-2804
CVSS V2 None
CVSS V3 None
Description
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrgext.c file. The vulnerability can only be exploited with 12-bit data precision for which the range of the sample data type exceeds the valid sample range, hence, an attacker could craft a 12-bit lossless JPEG image that contains out-of-range 12-bit samples. An application attempting to decompress such image using merged upsampling would lead to segmentation fault or buffer overflows, causing an application to crash.
Overview
- CVE ID
- CVE-2023-2804
- Assigner
- redhat
- Vulnerability Status
- PUBLISHED
- Published Version
- 2023-05-25T00:00:00
- Last Modified Date
- 2024-02-13T19:05:59.636100
Weakness Enumerations
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-2804 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2804 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-24 21:53:21 | Added to TrackCVE |