Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
How could an attacker exploit this vulnerability?
An authenticated attacker could exploit the vulnerability by uploading a malicious TIFF file to a server.
Why is Microsoft addressing CVE‑2023‑2804, a vulnerability originally reported by Red Hat?
Microsoft uses the open‑source libjpeg‑turbo component inside certain Windows imaging components. The vulnerability was fixed upstream in libjpeg‑turbo 3.0.2 (3.0.2 release notes), so Microsoft updated our internal copy accordingly. Customers do not need to take action—this fix is delivered through Microsoft servicing.
Security updates
10.0.25398.2149 — https://support.microsoft.com/help/5075897
Vulnerabilities 1
-
Medium 6.5
A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrg…
Revision history
-
#1
Information published.
References
-
CVE-2023-2804 Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-2804
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss