CVE-2023-37837
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A heap buffer overflow was discovered in the libjpeg library in the LineBitmapRequester::EncodeRegion function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Risk Assessment
Organizations may be exposed to attacks that lead to service unavailability related to image processing. This can impact the continuity and availability of applications.
Recommendation
It is recommended to update the libjpeg library to the latest version to mitigate this vulnerability. Additionally, monitor systems for unusual activities related to image file processing.
Other vulnerabilities in libjpeg
See all- CVE-2016-3616High
The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.
- CVE-2016-6702High
A remote code execution vulnerability in libjpeg in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process.
- CVE-2023-37836Medium
A vulnerability in the libjpeg library was discovered that allows for a reachable assertion in the BitMapHook::BitMapHook method in bitmaphook.cpp. This vulnerability can be exploited by attackers to cause a Denial of Service (DoS) via a crafted file.
Original NVD description (English source)
libjpeg commit db33a6e was discovered to contain a heap buffer overflow via LineBitmapRequester::EncodeRegion at linebitmaprequester.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS