The libjpeg package contains a library of functions for manipulating JPEGimages. It also contains simple client programs for accessing thelibjpeg functions.An uninitialized memory read issue was found in the way libjpeg decodedimages with missing Start Of Scan (SOS) JPEG markers. A remote attackercould create a specially crafted JPEG image that, when decoded, couldpossibly lead to a disclosure of potentially sensitive information.(CVE-2013-6629)All libjpeg users are advised to upgrade to this updated package, whichcontains a backported patch to correct this issue.

Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2016-3616) It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152, CVE-2020-14153) It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2018-11213, CVE-2018-11214)