VDB
GHSA-3rgw-2fpg-85mq
GHSA-3rgw-2fpg-85mq
PUBLISHED
Record from GitHub Advisory Database · Published May 24, 2022
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
Timeline
- May 24, 2022 CVE Published
- Apr 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-3rgw-2fpg-85mq
vulnetix vdb fixes GHSA-3rgw-2fpg-85mqOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-3rgw-2fpg-85mq/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-13790 advisory
- https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB url
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html url
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html url
- https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a url
- https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK url
- https://security.gentoo.org/glsa/202010-03 url
- https://usn.ubuntu.com/4386-1 url