CVE-2013-6630

描述

The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

如何修補 CVE-2013-6630

要修補 CVE-2013-6630,請將受影響套件升級到下列已修補版本。

• Debian/libjpeg-turbo—升級至 1.3.0-3 或更新版本

CVE-2013-6630 正在被利用嗎?

低 — EPSS 為 2.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.3.0-3

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2013-6630