Vulnerability Name:

CVE-2012-2806 (CCN-76952)

Assigned:2012-07-17
Published:2012-07-17
Updated:2017-08-29
Summary:Heap-based buffer overflow in the get_sos function in jdmarker.c in libjpeg-turbo 1.2.0 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large component count in the header of a JPEG image.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2012-2806

Source: CONFIRM
Type: UNKNOWN
http://libjpeg-turbo.svn.sourceforge.net/viewvc/libjpeg-turbo?view=revision&revision=830

Source: OSVDB
Type: UNKNOWN
84040

Source: CCN
Type: SA49883
libjpeg-turbo "get_sos()" JPEG Decompression Buffer Overflow Vulnerability

Source: SECUNIA
Type: Vendor Advisory
49883

Source: SECUNIA
Type: UNKNOWN
50753

Source: GENTOO
Type: UNKNOWN
GLSA-201209-13

Source: CCN
Type: libjpeg-turbo Web page
libjpeg-turbo

Source: CCN
Type: IBM Security Bulletin 733861 (System x Blades)
Vulnerabilities in libjpeg affect IBM BladeCenter Advanced Management Module (AMM)

Source: CCN
Type: IBM Security Bulletin 734731 (PureFlex System & Flex System)
IBM Flex System Chassis Management Module (CMM) is affected by vulnerabilities in libjpeg

Source: CCN
Type: IBM Security Bulletin 874446 (Dynamic System Analysis (DSA) Preboot)
IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in libjpeg

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2012:121

Source: CCN
Type: oss-security Mailing List, Tue, 17 Jul 2012 10:20:22 +0530
libjpeg-turbo: Heap-based buffer overflow when decompressing corrupt JPEG images

Source: MLIST
Type: UNKNOWN
[oss-security] 20120717 libjpeg-turbo: Heap-based buffer overflow when decompressing corrupt JPEG images

Source: CCN
Type: OSVDB ID: 84040
libjpeg-turbo jdmarker.c get_sos() Function JPEG Image File Handling Overflow

Source: BID
Type: UNKNOWN
54480

Source: CCN
Type: BID-54480
libjpeg-turbo Heap-Based Buffer Overflow Vulnerability

Source: MISC
Type: UNKNOWN
https://bugzilla.mozilla.org/show_bug.cgi?id=759802

Source: MISC
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=826849

Source: XF
Type: UNKNOWN
libjpegturbo-getsos-bo(76952)

Source: XF
Type: UNKNOWN
libjpegturbo-getsos-bo(76952)

Source: CCN
Type: IBM Security Bulletin 6572711 (Netezza Analytics for NPS)
Gdal vulnerabilities affect IBM Netezza Analytics for NPS

Source: CCN
Type: IBM Security Bulletin 6840129 (Transform Services for i)
IBM Transform Services for IBM i is vulnerable to denial of service, buffer overflow, and allowing attacker to obtain sensitive information due to multiple vulnerabilities.

Vulnerable Configuration:Configuration 1:
  • cpe:/a:d.r.commander:libjpeg-turbo:1.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:42331
    P
    		Security update for pcre2 (Important)
    2022-08-03
    oval:org.opensuse.security:def:20122806
    V
    		CVE-2012-2806
    2022-05-20
    oval:org.opensuse.security:def:33118
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:32287
    P
    		Security update for net-snmp (Important)
    2022-01-05
    oval:org.opensuse.security:def:32231
    P
    		Security update for clamav (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:33049
    P
    		Security update for java-1_7_0-openjdk (Important)
    2021-11-24
    oval:org.opensuse.security:def:31707
    P
    		Security update for postgresql10 (Important)
    2021-11-22
    oval:org.opensuse.security:def:31701
    P
    		Security update for pcre (Moderate)
    2021-11-10
    oval:org.opensuse.security:def:32211
    P
    		Security update for transfig (Important)
    2021-10-29
    oval:org.opensuse.security:def:26153
    P
    		Security update for git (Low)
    2021-10-20
    oval:org.opensuse.security:def:26130
    P
    		Security update for ghostscript (Critical)
    2021-09-21
    oval:org.opensuse.security:def:32992
    P
    		Security update for gstreamer-plugins-good (Moderate)
    2021-09-02
    oval:org.opensuse.security:def:32167
    P
    		Security update for openssl (Important)
    2021-08-24
    oval:org.opensuse.security:def:26104
    P
    		Security update for libcares2 (Important)
    2021-08-16
    oval:org.opensuse.security:def:32145
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:26082
    P
    		Security update for openexr (Important)
    2021-06-24
    oval:org.opensuse.security:def:31633
    P
    		Security update for libX11 (Important)
    2021-06-08
    oval:org.opensuse.security:def:42562
    P
    		jpeg-6b-879.12.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36155
    P
    		jpeg-6b-879.12.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36457
    P
    		libjpeg-devel-32bit-6.2.0-879.12.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32106
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-06-04
    oval:org.opensuse.security:def:31622
    P
    		Security update for graphviz (Critical)
    2021-05-19
    oval:org.opensuse.security:def:31621
    P
    		Security update for djvulibre (Important)
    2021-05-19
    oval:org.opensuse.security:def:26051
    P
    		Security update for djvulibre (Important)
    2021-05-19
    oval:org.opensuse.security:def:26046
    P
    		Security update for libxml2 (Moderate)
    2021-05-05
    oval:org.opensuse.security:def:32075
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:31609
    P
    		Security update for sudo (Important)
    2021-04-20
    oval:org.opensuse.security:def:33098
    P
    		Security update for python3 (Moderate)
    2021-03-19
    oval:org.opensuse.security:def:26206
    P
    		Security update for the Linux Kernel (Important)
    2021-03-09
    oval:org.opensuse.security:def:33079
    P
    		Security update for ImageMagick (Moderate)
    2021-02-19
    oval:org.opensuse.security:def:26192
    P
    		Security update for php72 (Important)
    2021-02-17
    oval:org.opensuse.security:def:26210
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:28952
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:32836
    P
    		Security update for PackageKit (Low)
    2020-12-22
    oval:org.opensuse.security:def:33881
    P
    		Security update for python (Important)
    2020-12-11
    oval:org.opensuse.security:def:35924
    P
    		jpeg-6b-879.12.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:32001
    P
    		Security update for python3 (Important)
    2020-12-02
    oval:org.opensuse.security:def:26432
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33137
    P
    		libadns1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26348
    P
    		Security update for SDL2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29829
    P
    		Security update for libjpeg
    2020-12-01
    oval:org.opensuse.security:def:26291
    P
    		Security update for python-reportlab (Important)
    2020-12-01
    oval:org.opensuse.security:def:29793
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29155
    P
    		Security update for libtcnative-1-0 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29111
    P
    		Security update for java-1_7_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:26018
    P
    		Security update for freerdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:32749
    P
    		mono-core on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29094
    P
    		Recommended update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:26007
    P
    		Security update for libid3tag (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32692
    P
    		kdenetwork4-filesharing on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29055
    P
    		Security update for bind (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26923
    P
    		jpeg on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26006
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:32598
    P
    		python on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29006
    P
    		Security update for gnutls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26888
    P
    		emacs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32463
    P
    		Security update for xorg-x11-libXpm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26250
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32385
    P
    		Security update for tightvnc (Important)
    2020-12-01
    oval:org.opensuse.security:def:28800
    P
    		Security update for openssh (Important)
    2020-12-01
    oval:org.opensuse.security:def:32374
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28716
    P
    		Security update for java-1_7_0-openjdk (Critical)
    2020-12-01
    oval:org.opensuse.security:def:32888
    P
    		jpeg on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32373
    P
    		Security update for tcpdump (Important)
    2020-12-01
    oval:org.opensuse.security:def:28659
    P
    		Security update for emacs
    2020-12-01
    oval:org.opensuse.security:def:32849
    P
    		dhcpcd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28574
    P
    		Security update for MySQL
    2020-12-01
    oval:org.opensuse.security:def:28443
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:28375
    P
    		Security update for quagga (Low)
    2020-12-01
    oval:org.opensuse.security:def:25900
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:28364
    P
    		Security update for postgresql94 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25816
    P
    		Security update for libqt4 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27153
    P
    		jpeg on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28363
    P
    		Security update for postgresql94 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25759
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32057
    P
    		Security update for kvm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27118
    P
    		evince on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25678
    P
    		Security update for kernel-firmware (Important)
    2020-12-01
    oval:org.opensuse.security:def:26480
    P
    		Security update for okular (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25550
    P
    		Security update for squid (Important)
    2020-12-01
    oval:org.opensuse.security:def:31845
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:26436
    P
    		Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25486
    P
    		Security update for openssl-1_1 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31758
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:26422
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:25475
    P
    		Security update for libssh (Important)
    2020-12-01
    oval:org.opensuse.security:def:26383
    P
    		Security update for Mozilla Thunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25474
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:26334
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:32441
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:31477
    P
    		Security update for puppet (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26281
    P
    		Security update for hexchat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32397
    P
    		Security update for unzip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31403
    P
    		Security update for perl-DBD-mysql (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32375
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31392
    P
    		Security update for pam-modules (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32336
    P
    		Security update for sane-backends (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27455
    P
    		libjpeg-devel-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31391
    P
    		Security update for pam (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25989
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27420
    P
    		imlib2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25908
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26782
    P
    		man on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25780
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26738
    P
    		libapr-util1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25716
    P
    		Security update for librsvg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31988
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:26724
    P
    		kdebase3-runtime on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25705
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31931
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:26685
    P
    		dhcp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33842
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25704
    P
    		Security update for ppp (Important)
    2020-12-01
    oval:org.opensuse.security:def:31839
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:26636
    P
    		rsync on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33204
    P
    		man on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26583
    P
    		libarchive2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33160
    P
    		libmpfr1 on GA media (Moderate)
    2020-12-01
    oval:com.ubuntu.precise:def:20122806000
    V
    		CVE-2012-2806 on Ubuntu 12.04 LTS (precise) - medium.
    2012-08-13
    BACK
    d.r.commander libjpeg-turbo 1.2.0