{"id":"CVE-2020-17541","aliases":["ALSA-2021:4288","AZL-6637","DEBIAN-CVE-2020-17541","EUVD-2020-9472","GHSA-vhxw-68wq-v5j9","JLSEC-2025-179","RHSA-2021:4288","RLSA-2021:4288","SUSE-SU-2021:1957-1","SUSE-SU-2021:1958-1","UBUNTU-CVE-2020-17541","USN-5553-1","USN-5631-1","openSUSE-SU-2021:0892-1","openSUSE-SU-2021:1958-1"],"status":"published","title":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A...","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02728,"percentile":0.86174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-06-01T14:44:41Z","modified":"2026-11-05T12:15:07Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"libjpeg-turbo","fixed_in":["1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-devel","fixed_in":["1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-utils","fixed_in":["1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"turbojpeg","fixed_in":["1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"turbojpeg-devel","fixed_in":["1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libjpeg-turbo","fixed_in":["2.0.0-9"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"JpegTurbo_jll","fixed_in":["2.1.0+0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debuginfo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debugsource","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-devel","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils-debuginfo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg-debuginfo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debuginfo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debugsource","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-utils-debuginfo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-debuginfo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-devel","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libjpeg-turbo","fixed_in":["0:1.5.3-12.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg62-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg62-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","fixed_in":["1.3.0-0ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg-turbo","fixed_in":["1.4.2-0ubuntu3.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","fixed_in":["1.5.2-0ubuntu5.18.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","fixed_in":["2.0.3-0ubuntu1.20.04.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libjpeg-turbo","fixed_in":["1.5.3-lp152.8.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libjpeg62-turbo","fixed_in":["1.5.3-lp152.8.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libjpeg-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libjpeg62-turbo","fixed_in":["1.5.3-5.18.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"JpegTurbo_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0+0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-12.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-0ubuntu2.1+esm2"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1","1.3.0-0ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.4+esm1"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1","1.4.2-0ubuntu3.3","1.4.2-0ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.6"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3","1.5.2-0ubuntu5.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-0ubuntu1.20.04.3"}]}],"versions":["2.0.3-0ubuntu1","2.0.3-0ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-0ubuntu2.1+esm2"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1","1.3.0-0ubuntu2.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.4+esm1"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1","1.4.2-0ubuntu3.3","1.4.2-0ubuntu3.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.6"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3","1.5.2-0ubuntu5.18.04.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-0ubuntu1.20.04.3"}]}],"versions":["2.0.3-0ubuntu1","2.0.3-0ubuntu1.20.04.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp152.8.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp152.8.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.18.1"}]}]}],"products":[{"vendor":"libjpeg-turbo","product":"libjpeg-turbo"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/121.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/issues/392","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17541","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vhxw-68wq-v5j9"},{"url":"https://access.redhat.com/errata/RHSA-2021:4288","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1968036","tags":["report"]},{"url":"https://bugzilla.redhat.com/1982572","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4288.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-17541","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-17541","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1968036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982572","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4288.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-17541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-17541","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4288","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211957-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17541","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211958-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-17541","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5553-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5631-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-11813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14498","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-35538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46822","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5QFMY5PC6YGRRPOTKEDLIS6VQ2KCVUDF/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JEVT5FS4C2453YNMGNJH5GEW4YPAD5DS/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-17541","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T14:44:41Z","modified":"2024-08-04T14:00:48.686Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2020-9472","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T14:44:41Z","modified":"2024-08-04T14:00:48Z","updated_at":"2026-11-03T03:07:26.951665Z"}],"ghsa":[{"id":"GHSA-vhxw-68wq-v5j9","title":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A...","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2022-05-24T19:03:42Z","modified":"2023-01-27T05:02:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:42:06.500861Z"}],"nvd":[{"id":"CVE-2020-17541","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T15:15:07.417Z","modified":"2026-06-17T02:59:06.48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:43.288951Z"}],"osv":[{"id":"AZL-6637","title":"CVE-2020-17541 affecting package libjpeg-turbo for versions less than 2.0.0-9","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T15:15:07Z","modified":"2026-04-21T04:37:51.16958Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"CVE-2020-17541","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T15:15:07.417Z","modified":"2026-10-20T10:52:02.601167818Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.212689Z"},{"id":"DEBIAN-CVE-2020-17541","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T15:15:07.417Z","modified":"2026-10-26T12:02:28.827338375Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"JLSEC-2025-179","title":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2025-10-21T17:39:06.495Z","modified":"2026-07-18T00:00:25.487330728Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RHSA-2021:4288","title":"Red Hat Security Advisory: libjpeg-turbo security and bug fix update","status":"published","published":"2024-09-16T06:08:36Z","modified":"2026-06-26T12:21:16.466432247Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4288","title":"Moderate: libjpeg-turbo security and bug fix update","description":"The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg-turbo: Stack-based buffer overflow in the \"transform\" component (CVE-2020-17541)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:56:07Z","modified":"2026-02-04T14:00:11.05879Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-17541","description":"Libjpeg-turbo all version have a stack-based buffer overflow in the \"transform\" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.","status":"published","published":"2021-06-01T15:15:00Z","modified":"2026-04-22T12:31:43.352301Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"ALSA-2021:4288","title":"Moderate: libjpeg-turbo security and bug fix update","description":"The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg-turbo: Stack-based buffer overflow in the \"transform\" component (CVE-2020-17541)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:56:07Z","modified":"2026-11-05T12:15:07.112963797Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"openSUSE-SU-2021:0892-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-17541: Fixed a stack-based buffer overflow in the 'transform' component (bsc#1186764).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-16T14:07:13Z","modified":"2026-02-04T02:20:59.876633Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1958-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-17541: Fixed a stack-based buffer overflow in the 'transform' component (bsc#1186764).\n","status":"published","published":"2021-07-10T19:10:52Z","modified":"2025-05-07T18:11:47.266374Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:1957-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-17541: Fixed a stack-based buffer overflow in the 'transform' component (bsc#1186764).\n","status":"published","published":"2021-06-11T10:53:56Z","modified":"2026-02-04T02:13:59.572262Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1958-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-17541: Fixed a stack-based buffer overflow in the 'transform' component (bsc#1186764).\n","status":"published","published":"2021-06-11T10:55:20Z","modified":"2026-02-04T02:18:39.499951Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-5553-1","title":"libjpeg-turbo vulnerabilities","description":"It was discovered that libjpeg-turbo was not properly handling EOF characters,\nwhich could lead to excessive memory consumption through the execution of a\nlarge loop. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2018-11813)\n\nIt was discovered that libjpeg-turbo was not properly performing bounds\ncheck operations, which could lead to a heap-based buffer overread. If a user\nor automated system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 14.04 ESM. (CVE-2018-14498)\n\nIt was discovered that libjpeg-turbo was not properly limiting the amount of\nmain memory being consumed by the system during decompression or multi-pass\ncompression operations, which could lead to excessive memory consumption. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2020-14152)\n\nIt was discovered that libjpeg-turbo was not properly setting variable sizes\nwhen performing certain kinds of encoding operations, which could lead to a\nstack-based buffer overflow. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-17541)\n","status":"published","published":"2022-08-08T12:06:20Z","modified":"2026-06-29T13:49:40.215117423Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5631-1","title":"libjpeg-turbo vulnerabilities","description":"It was discovered that libjpeg-turbo incorrectly handled certain EOF\ncharacters. An attacker could possibly use this issue to cause\nlibjpeg-turbo to consume resource, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS. (CVE-2018-11813)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain malformed\njpeg files. An attacker could possibly use this issue to cause\nlibjpeg-turbo to crash, resulting in a denial of service. (CVE-2020-17541,\nCVE-2020-35538)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain malformed\nPPM files. An attacker could use this issue to cause libjpeg-turbo to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-46822)\n","status":"published","published":"2022-09-22T16:49:20Z","modified":"2026-04-27T16:32:24.813887813Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}