CVE-2013-6629: artifex gpl_ghostscript

CVSS: 5.0v2.0MediumModified

AliasesRHSA-2013:1804DEBIAN-CVE-2013-6629

Published 15-11-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-6629 is a medium (CVSS 5.0) vulnerability in artifex gpl_ghostscript. EPSS estimates a 9.73% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities.

Overall risk

22/100

0100

Low · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

9.73%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 6

DSA-2799-1 DSA-2923-1 MGASA-2013-0324 MGASA-2013-0333 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10171-1+13 more

Timeline

15-11-2013
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

9.73%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 9.73% on 19-09-2026

19-09-202619-10-2026

EPSS score

9.73%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Mozilla3 products

firefox< 24.2 | < 26.0
seamonkey< 2.23
thunderbird< 24.2.0

Redhat3 products

libjpeg< 0:6b-38
libjpeg-debuginfo< 0:6b-38
libjpeg-devel< 0:6b-38

Debian2 products

libjpeg-turbo< 1.3.0-3
debian_linuxEOL7.0 | 8.0

Artifex1 product

gpl_ghostscript< 9.03

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 12.10 | 13.04 | 13.10

Fedoraproject1 product

fedoraEOL18 | 19 | 20

Google1 product

chrome< 31.0.1650.48

Libjpeg-turbo1 product

libjpeg-turbo< 1.3.1

Opensuse1 product

opensuseEOL12.2 | 12.3 | 13.1

Oracle1 product

solarisEOL11.3

10 vendors · 15 products

References

60 links

archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.htmlMailing ListX Refsource FULLDISCBroken Link
www.securityfocus.com/bid/63676VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.ibm.com/support/docview.wss?uid=swg21675973X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2014:0414Vendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/glsa-201406-32.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-1804.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-updates/2013-12/msg00120.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
marc.info?l=bugtraq&m=140852886808946&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21672080X Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2014:0413Vendor AdvisoryX Refsource REDHATThird Party Advisory

Show all 60 references

secunia.com/advisories/59058Third Party AdvisoryX Refsource SECUNIANot Applicable
rhn.redhat.com/errata/RHSA-2013-1803.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-updates/2013-12/msg00119.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
marc.info?l=bugtraq&m=140852974709252&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
support.apple.com/kb/HT6163X Refsource CONFIRMThird Party Advisory
secunia.com/advisories/56175Third Party AdvisoryX Refsource SECUNIANot Applicable
lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2014-01/msg00042.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
secunia.com/advisories/58974Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securitytracker.com/id/1029470VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=891693X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
lists.opensuse.org/opensuse-updates/2013-12/msg00086.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.mozilla.org/security/announce/2013/mfsa2013-116.htmlX Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT6150X Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-updates/2013-12/msg00121.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRMThird Party Advisory
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2013-6629X Refsource CONFIRMPatchThird Party Advisory
www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-updates/2013-12/msg00085.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-updates/2014-01/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
googlechromereleases.blogspot.com/2013/11/stable-channel-update.htmlX Refsource CONFIRMVendor Advisory
www.securitytracker.com/id/1029476VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
src.chromium.org/viewvc/chrome?revision=229729&view=revisionX Refsource CONFIRMPatchThird Party Advisory
security.gentoo.org/glsa/201606-03Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg21676746X Refsource CONFIRMBroken Link
lists.opensuse.org/opensuse-updates/2013-12/msg00087.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
support.apple.com/kb/HT6162X Refsource CONFIRMThird Party Advisory
code.google.com/p/chromium/issues/detail?id=258723X Refsource CONFIRMIssue TrackingThird Party Advisory
www.ubuntu.com/usn/USN-2052-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.debian.org/security/2013/dsa-2799Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705X Refsource CONFIRMThird Party Advisory
advisories.mageia.org/MGASA-2013-0333.htmlX Refsource CONFIRMThird Party Advisory
bugs.ghostscript.com/show_bug.cgi?id=686980X Refsource CONFIRMIssue TrackingVendor Advisory
www.mandriva.com/security/advisories?name=MDVSA-2013:273Vendor AdvisoryX Refsource MANDRIVABroken Link
www.ubuntu.com/usn/USN-2060-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.ubuntu.com/usn/USN-2053-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2013:1804Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1031734REPORT
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1804.jsonAdvisory
access.redhat.com/security/cve/CVE-2013-6629REPORT
www.cve.org/CVERecord?id=CVE-2013-6629Advisory
nvd.nist.gov/vuln/detail/CVE-2013-6629Advisory
security-tracker.debian.org/tracker/CVE-2013-6629Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities