CVE-2020-35538
Summary
| CVE | CVE-2020-35538 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-31 16:15:09 UTC |
| Updated | 2026-11-02 18:18:29 UTC |
| Description | A crafted input file could cause a null pointer dereference in jcopy_sample_rows() when processed by libjpeg-turbo. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS: 0.002860000 probability, percentile 0.211330000 (date 2026-11-02)
Problem Types: CWE-476 | CWE-476 CWE-476
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Libjpeg-turbo | Libjpeg-turbo | 2.0.5 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Libjpeg-turbo | affected libjpeg-turbo 2.0.5 onwards | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| jcopy_sample_rows() causes SIGSEGV · Issue #441 · libjpeg-turbo/libjpeg-turbo · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Issue Tracking, Third Party Advisory |
| Fix jpeg_skip_scanlines() segfault w/merged upsamp · libjpeg-turbo/libjpeg-turbo@9120a24 · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 198956 Ubuntu Security Notification for libjpeg-turbo Vulnerabilities (USN-5631-1)
- 502735 Alpine Linux Security Update for libjpeg-turbo
- 672344 EulerOS Security Update for libjpeg-turbo (EulerOS-SA-2022-2733)
- 672370 EulerOS Security Update for libjpeg-turbo (EulerOS-SA-2022-2768)
- 672432 EulerOS Security Update for libjpeg-turbo (EulerOS-SA-2022-2849)
- 672470 EulerOS Security Update for libjpeg-turbo (EulerOS-SA-2022-2824)
- 752640 SUSE Enterprise Linux Security Update for libjpeg-turbo (SUSE-SU-2022:3475-1)
- 752653 SUSE Enterprise Linux Security Update for libjpeg-turbo (SUSE-SU-2022:3523-1)
- 903724 Common Base Linux Mariner (CBL-Mariner) Security Update for libjpeg-turbo (10816) (DEPRECATED)
- 903839 Common Base Linux Mariner (CBL-Mariner) Security Update for libjpeg-turbo (10824)
- 904098 Common Base Linux Mariner (CBL-Mariner) Security Update for libjpeg-turbo (10816-1)
- 904132 Common Base Linux Mariner (CBL-Mariner) Security Update for libjpeg-turbo (10824-1)