libjpeg 9c has a large loop because readpixel in rdtarga.c mishandles EOF.

References:

https://github.com/ChijinZ/securityadvisories/blob/master/libjpeg-v9c/mail.pdf https://github.com/ChijinZ/securityadvisories/tree/master/libjpeg-v9c

It was discovered that Libjpeg6b was not properly performing bounds checks when compressing PPM and Targa image files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-11212) Chijin Zhou discovered that Libjpeg6b was incorrectly handling the EOF character in input data when generating JPEG files. An attacker could possibly use this issue to force the execution of a large loop, force excessive memory consumption, and cause a denial of service. (CVE-2018-11813) Sheng Shu and Dongdong She discovered that Libjpeg6b was not properly limiting the amount of memory being used when it was performing decompression or multi-pass compression operations. An attacker could possibly use this issue to force excessive memory consumption and cause a denial of service. (CVE-2020-14152)

Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2016-3616) It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152, CVE-2020-14153) It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code. (CVE-2018-11213, CVE-2018-11214)

An issue was discovered in libjpeg version 9a. The allocsarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

References: https://github.com/ChijinZ/securityadvisories/tree/master/libjpeg-v9a

An issue was discovered in libjpeg version 9a. The gettextrgbrow function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

References: https://github.com/ChijinZ/securityadvisories/tree/master/libjpeg-v9a

An issue was discovered in libjpeg version 9a. The gettextgrayrow function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

References: https://github.com/ChijinZ/securityadvisories/tree/master/libjpeg-v9a

The libjpeg package contains a library of functions for manipulating JPEGimages. It also contains simple client programs for accessing thelibjpeg functions.An uninitialized memory read issue was found in the way libjpeg decodedimages with missing Start Of Scan (SOS) JPEG markers. A remote attackercould create a specially crafted JPEG image that, when decoded, couldpossibly lead to a disclosure of potentially sensitive information.(CVE-2013-6629)All libjpeg users are advised to upgrade to this updated package, whichcontains a backported patch to correct this issue.