{"id":"CVE-2020-13790","aliases":["ALPINE-CVE-2020-13790","ALSA-2025:7540","BELL-CVE-2020-13790","DEBIAN-CVE-2020-13790","DLA-2302-1","EUVD-2020-6006","GHSA-3rgw-2fpg-85mq","MGASA-2020-0267","RHSA-2025:7540","RLSA-2025:7540","SUSE-SU-2020:2569-1","SUSE-SU-2020:2570-1","UBUNTU-CVE-2020-13790","USN-4386-1","openSUSE-SU-2020:1413-1","openSUSE-SU-2020:1458-1","openSUSE-SU-2024:10952-1"],"status":"published","title":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in...","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03178,"percentile":0.88162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-06-03T18:56:05Z","modified":"2026-10-29T11:02:23Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libjpeg-turbo","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libjpeg-turbo","fixed_in":["2.0.4-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libjpeg-turbo","fixed_in":["2.0.4-r2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libjpeg-turbo","fixed_in":["1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-devel","fixed_in":["1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-utils","fixed_in":["1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"turbojpeg","fixed_in":["1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"turbojpeg-devel","fixed_in":["1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"libjpeg","fixed_in":["2.0.4-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debuginfo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debugsource","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-devel","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils-debuginfo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg-debuginfo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debuginfo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debugsource","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-utils-debuginfo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-debuginfo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-devel","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libjpeg-turbo","fixed_in":["0:1.5.3-14.el8_10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libjpeg-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libjpeg62-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg62-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"libjpeg-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libjpeg-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"libjpeg-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"libjpeg-turbo","fixed_in":["1.5.3-5.15.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.22.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.22.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","fixed_in":["1.3.0-0ubuntu2.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libjpeg-turbo","fixed_in":["1.4.2-0ubuntu3.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","fixed_in":["1.5.2-0ubuntu5.18.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","fixed_in":["2.0.3-0ubuntu1.20.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"libjpeg-turbo","fixed_in":["1.5.3-lp151.6.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"libjpeg62-turbo","fixed_in":["1.5.3-lp151.6.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libjpeg-turbo","fixed_in":["1.5.3-lp152.8.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libjpeg62-turbo","fixed_in":["1.5.3-lp152.8.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-2+deb9u1"}]}],"versions":["1:1.5.1-2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:7","package":"libjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-14.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.15.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.22.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.22.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-0ubuntu2.1+esm1"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.4"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1","1.4.2-0ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.4"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-0ubuntu1.20.04.1"}]}],"versions":["2.0.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-0ubuntu2.1+esm1"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.4"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1","1.4.2-0ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.4"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-0ubuntu1.20.04.1"}]}],"versions":["2.0.3-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp151.6.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp151.6.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp152.8.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp152.8.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.2-65.2"}]}],"bundled":7}],"products":[{"vendor":"libjpeg-turbo","product":"libjpeg-turbo"},{"vendor":"mozilla","product":"mozjpeg"}],"references":[{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/issues/433","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d11d4b90f4a47136467053eb2d09a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/4386-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00062.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202010-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13790","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4D6KNUY7YANSPH7SVQ44PJKSABFKAUB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U6563YHSVZK24MPJXGJVK3CQG7JVWZGK/"},{"url":"https://github.com/advisories/GHSA-3rgw-2fpg-85mq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13790","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13790","tags":["report"]},{"url":"https://bugzilla.redhat.com/1847155","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-7540.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-13790","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-13790","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0267.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26784","tags":["report"]},{"url":"https://usn.ubuntu.com/usn/usn-4386-1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847155","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7540.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13790","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7540","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202569-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13790","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202570-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-13790","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4386-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/52QOQYR4PVDHN5TNNBKZFP3AO4TWOOJE/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QKR5P4LZGKKVQJWLSSC2P3H2MGGEO5I4/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20330","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T18:56:05Z","modified":"2024-08-04T12:25:16.551Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-6006","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T18:56:05Z","modified":"2024-08-04T12:25:16Z","updated_at":"2026-11-03T03:07:36.6695Z"}],"ghsa":[{"id":"GHSA-3rgw-2fpg-85mq","title":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in...","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2022-05-24T17:19:03Z","modified":"2023-01-29T05:02:48Z","updated_at":"2026-11-02T14:45:10.478665Z"}],"nvd":[{"id":"CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T19:15:10.817Z","modified":"2026-06-17T02:53:39.567Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:04.922138Z"}],"osv":[{"id":"ALPINE-CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T19:15:10.817Z","modified":"2026-10-26T11:17:55.113502852Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-13790","title":"CVE-2020-13790 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:46.797877Z","modified":"2026-01-26T09:47:23.564856Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T19:15:10.817Z","modified":"2026-10-24T14:13:13.957495258Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T19:15:10.817Z","modified":"2026-10-26T12:00:34.037194925Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"RHSA-2025:7540","title":"Red Hat Security Advisory: libjpeg-turbo security update","status":"published","published":"2025-05-14T10:06:56Z","modified":"2026-06-26T12:22:40.446974623Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7540","title":"Moderate: libjpeg-turbo security update","description":"The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg-turbo: heap-based buffer over-read in get_rgb_row() in rdppm.c (CVE-2020-13790)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T14:33:17.932445Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2020-13790","description":"libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.","status":"published","published":"2020-06-03T19:15:00Z","modified":"2026-04-22T12:29:11.022993Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"ALSA-2025:7540","title":"Moderate: libjpeg-turbo security update","description":"The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.  \n\nSecurity Fix(es):  \n\n  * libjpeg-turbo: heap-based buffer over-read in get_rgb_row() in rdppm.c (CVE-2020-13790)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-14T00:00:00Z","modified":"2026-10-29T11:02:23.037863539Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"DLA-2302-1","title":"libjpeg-turbo - security update","status":"published","published":"2020-07-31T00:00:00Z","modified":"2026-03-09T01:19:08.322972Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2020-0267","title":"Updated libjpeg packages fix security vulnerability","description":"Updated libjpeg packages fix security vulnerability:\n\nlibjpeg-turbo 2.0.4 has a heap-based buffer over-read in get_rgb_row()\nin rdppm.c via a malformed PPM input file (CVE-2020-13790).\n","status":"published","published":"2020-06-19T10:25:21Z","modified":"2026-04-16T04:40:58.601572647Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1413-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-13790: Fixed a heap-based buffer over-read via a malformed PPM input file (bsc#1172491).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-09-11T14:25:03Z","modified":"2026-02-04T03:54:03.877408Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1458-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-13790: Fixed a heap-based buffer over-read via a malformed PPM input file (bsc#1172491).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-09-19T12:21:27Z","modified":"2026-02-04T02:36:18.526304Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10952-1","title":"libjpeg-turbo-2.1.1-65.2 on GA media","description":"These are all security issues fixed in the libjpeg-turbo-2.1.1-65.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:40:26.197209Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2020:2569-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-13790: Fixed a heap-based buffer over-read via a malformed PPM input file (bsc#1172491).\n","status":"published","published":"2020-09-08T12:59:16Z","modified":"2026-02-04T03:54:21.554791Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2570-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-13790: Fixed a heap-based buffer over-read via a malformed PPM input file (bsc#1172491).\n","status":"published","published":"2020-09-08T12:59:43Z","modified":"2026-02-04T04:01:37.409022Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-4386-1","title":"libjpeg-turbo vulnerability","description":"It was discovered that libjpeg-turbo incorrectly handled certain PPM files.\nAn attacker could possibly use this issue to access sensitive information.\n","status":"published","published":"2020-06-09T17:44:10Z","modified":"2026-06-29T13:48:02.447905664Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}