{"id":"CVE-2020-35538","aliases":["ALPINE-CVE-2020-35538","AZL-10824","AZL-43462","AZL-44676","BELL-CVE-2020-35538","DEBIAN-CVE-2020-35538","EUVD-2020-23205","GHSA-grwc-h387-x9h2","OESA-2022-1915","OESA-2022-1916","SUSE-SU-2022:3475-1","SUSE-SU-2022:3523-1","UBUNTU-CVE-2020-35538","USN-5631-1"],"status":"published","title":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed...","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00286,"percentile":0.21247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-08-31T15:33:04Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libjpeg-turbo","fixed_in":["2.0.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libjpeg-turbo","fixed_in":["2.1.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libjpeg-turbo","fixed_in":["1:2.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libjpeg-turbo","fixed_in":["1:2.0.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjpeg-turbo","fixed_in":["1:2.0.6-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"libjpeg-turbo","fixed_in":["2.0.5-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"libjpeg-turbo","fixed_in":["2.0.5-3.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg-turbo","fixed_in":["1.5.3-31.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg62-turbo","fixed_in":["1.5.3-31.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg62-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libjpeg-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libjpeg62-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"libjpeg62-turbo","fixed_in":["1.5.3-150000.32.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","fixed_in":["1.5.2-0ubuntu5.18.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","fixed_in":["2.0.3-0ubuntu1.20.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"gdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.6.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.6-1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-3.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-150000.32.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.6"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3","1.5.2-0ubuntu5.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-0ubuntu1.20.04.3"}]}],"versions":["2.0.3-0ubuntu1","2.0.3-0ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.6"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1","1.5.2-0ubuntu5.18.04.3","1.5.2-0ubuntu5.18.04.4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-0ubuntu1.20.04.3"}]}],"versions":["2.0.3-0ubuntu1","2.0.3-0ubuntu1.20.04.1"],"bundled":4}],"products":[{"vendor":"libjpeg-turbo","product":"libjpeg-turbo"},{"vendor":"tenable","product":"libjpeg-turbo"}],"references":[{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/issues/441","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9120a247436e84c0b4eea828cb11e8f665fcde30","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35538","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-grwc-h387-x9h2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-35538","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-35538","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35538","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1915","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1916","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202915","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35538","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223523-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35538","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-35538","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5631-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-17541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46822","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-35538","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T15:33:04Z","modified":"2026-11-02T17:55:09.707Z","cwes":["CWE-476"],"updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2020-23205","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T15:33:04Z","modified":"2026-11-02T17:55:09Z","updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-grwc-h387-x9h2","title":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed...","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-09-01T00:00:22Z","modified":"2023-01-28T05:06:49Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:44:28.28087Z"}],"nvd":[{"id":"CVE-2020-35538","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09.04Z","modified":"2026-11-02T18:18:29.497Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"ALPINE-CVE-2020-35538","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09.04Z","modified":"2026-10-26T11:17:55.172869028Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-10824","title":"CVE-2020-35538 affecting package libjpeg-turbo for versions less than 2.1.4-1","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09Z","modified":"2026-04-21T04:21:33.398422Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"AZL-43462","title":"CVE-2020-35538 affecting package gdal 3.6.3-5","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09Z","modified":"2026-04-21T04:31:00.890388Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44676","title":"CVE-2020-35538 affecting package gdal 3.6.3-2","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"BELL-CVE-2020-35538","title":"CVE-2020-35538 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:03.539822Z","modified":"2026-01-26T09:49:05.935369Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-35538","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09.04Z","modified":"2026-11-04T07:07:01.650625338Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-04T07:32:23.735279Z"},{"id":"DEBIAN-CVE-2020-35538","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:09.04Z","modified":"2026-11-03T09:47:30.637722623Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T10:27:58.933618Z"},{"id":"OESA-2022-1915","title":"libjpeg-turbo security update","description":"libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems.\r\n\r\nSecurity Fix(es):\r\n\r\nA crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.(CVE-2020-35538)","status":"published","published":"2022-09-16T11:05:13Z","modified":"2026-08-18T01:17:17.124098747Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-1916","title":"libjpeg-turbo security update","description":"libjpeg-turbo is a JPEG image codec that uses SIMD instructions (MMX, SSE2, NEON, AltiVec) to accelerate baseline JPEG compression and decompression on x86, x86-64, and ARM systems.\r\n\r\nSecurity Fix(es):\r\n\r\nA crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.(CVE-2020-35538)","status":"published","published":"2022-09-16T11:05:13Z","modified":"2026-08-18T01:17:17.149583431Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2020-35538","description":"A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo.","status":"published","published":"2022-08-31T16:15:00Z","modified":"2026-04-22T12:41:00.306993Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"SUSE-SU-2022:3475-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-35538: Fixed null pointer dereference in jcopy_sample_rows() function (bsc#1202915).\n","status":"published","published":"2022-09-30T09:19:02Z","modified":"2026-02-04T03:14:20.020294Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3523-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\n- CVE-2020-35538: Fixed null pointer dereference in jcopy_sample_rows() function (bsc#1202915).\n\n","status":"published","published":"2022-10-04T16:05:42Z","modified":"2026-02-04T03:34:58.257707Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5631-1","title":"libjpeg-turbo vulnerabilities","description":"It was discovered that libjpeg-turbo incorrectly handled certain EOF\ncharacters. An attacker could possibly use this issue to cause\nlibjpeg-turbo to consume resource, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS. (CVE-2018-11813)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain malformed\njpeg files. An attacker could possibly use this issue to cause\nlibjpeg-turbo to crash, resulting in a denial of service. (CVE-2020-17541,\nCVE-2020-35538)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain malformed\nPPM files. An attacker could use this issue to cause libjpeg-turbo to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-46822)\n","status":"published","published":"2022-09-22T16:49:20Z","modified":"2026-04-27T16:32:24.813887813Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}