NVD Vulnerability Detail

CVE-2021-29390

Summary	libjpeg-turbo version 2.0.90 has a heap-based buffer over-read (2 bytes) in decompress_smooth_data in jdcoefct.c.
Publication Date	Aug. 23, 2023, 4:16 a.m.
Registration Date	Aug. 23, 2023, 10 a.m.
Last Update	Nov. 21, 2024, 3:01 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:2.0.90:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1943797	Issue Tracking Permissions Required
2	https://bugzilla.redhat.com/show_bug.cgi?id=1943797	Issue Tracking Permissions Required
3	https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595	Issue Tracking
4	https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595	Issue Tracking
5	https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c	Patch
6	https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c	Patch
7	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
8	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
12	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

libjpeg-turbo の libjpeg-turbo 等複数ベンダの製品における境界外書き込みに関する脆弱性

Title	libjpeg-turbo の libjpeg-turbo 等複数ベンダの製品における境界外書き込みに関する脆弱性
Summary	libjpeg-turbo の libjpeg-turbo 等複数ベンダの製品には、境界外書き込みに関する脆弱性が存在します。
Possible impacts	情報を取得される、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	March 29, 2021, midnight
Registration Date	Jan. 23, 2024, 11:16 a.m.
Last Update	Jan. 23, 2024, 11:16 a.m.

Affected System

Fedora Project

Fedora 37

Fedora 38

Fedora 39

libjpeg-turbo

libjpeg-turbo 2.0.90

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-29390	https://www.cve.org/CVERecord?id=CVE-2021-29390
National Vulnerability Database (NVD)
2	CVE-2021-29390	https://nvd.nist.gov/vuln/detail/CVE-2021-29390

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

その他

No	Name	URL
関連文書
1	github.com (jdcoefct.c#L595)	https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595
2	github.com (jdcoefct.c)	https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c
3	lists.fedoraproject.org (27NR3KG553CG6LGPMP6SHWEVHTYPL6RC)	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
4	lists.fedoraproject.org (6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT)	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
5	lists.fedoraproject.org (KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3)	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/

Change Log

No	Changed Details	Date of change
1	[2024年01月23日] 掲載	Jan. 23, 2024, 11:16 a.m.