VDB
ALPINE-CVE-2020-13790
ALPINE-CVE-2020-13790
PUBLISHED
CVSS 8.100000381469727 HIGH
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.21 | libjpeg-turbo | 0, 0, 2.0.4-r1 |
| Alpine:v3.22 | libjpeg-turbo | 1.5.3-r1, 0, 0 |
| Alpine:v3.19 | libjpeg-turbo | 1.5.2-r0, 1.2.1-r1, 1.3.0-r0 |
| Alpine:v3.20 | libjpeg-turbo | 1.4.2-r0, 1.5.3-r1, 0 |
| Alpine:v3.16 | libjpeg-turbo | 0, 0, 1.2.1-r0 |
| Alpine:v3.17 | libjpeg-turbo | 1.2.1-r0, 0, 1.5.3-r1 |
| Alpine:v3.18 | libjpeg-turbo | 1.5.3-r4, 0, 1.2.1-r0 |
| Alpine:v3.14 | libjpeg-turbo | 1.5.3-r2, 1.5.3-r3, 2.0.2-r0 |
| Alpine:v3.15 | libjpeg-turbo | 2.0.4-r0, 1.5.3-r0, 1.5.3-r2 |
| Alpine:v3.13 | libjpeg-turbo | 1.5.2-r0, 1.5.1-r0, 1.5.0-r0 |
| Alpine:v3.23 | libjpeg-turbo | 0, 1.2.1-r0, 1.2.1-r1 |
| Alpine:v3.10 | libjpeg-turbo | 0, 0, 1.2.1-r0 |
| Alpine:v3.11 | libjpeg-turbo | 1.5.3-r3, 1.2.1-r1, 1.2.1-r2 |
| Alpine:v3.12 | libjpeg-turbo | 0, 2.0.4-r0, 2.0.4-r1 |
| Alpine:v3.24 | libjpeg-turbo | 0, 0 |
Timeline
- Jun 3, 2020 CVE Published
- Apr 30, 2026 Distribution Patch
- Jun 15, 2026 CVE Updated