Description
The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a grayscale buffer and loading a 16-bit binary PGM file into an RGB buffer. This is related to a heap-based buffer overflow in the get_word_rgb_row function in rdppm.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libjpeg-turbo | 1:2.1.1-1 | — |
| Debian 13 | libjpeg-turbo | 1:2.1.1-1 | — |
| Debian 12 | libjpeg-turbo | 1:2.1.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libjpeg-turbo | 2.0.3-0ubuntu1.20.04.3 | USN-5631-1 |
| Ubuntu 18.04 LTS | libjpeg-turbo | 1.5.2-0ubuntu5.18.04.6 | USN-5631-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | turbojpeg +4 | 2.0.90-6.el9_1 | RHSA-2023:1068 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | turbojpeg +4 | 2.0.90-6.el9_1 | ALSA-2023:1068 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | libjpeg-turbo | 2.0.90-6.el9_1 | RLSA-2023:1068 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | turbojpeg +4 | 2.0.90-2.amzn2.0.2 | ALAS2-2023-2214 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | turbojpeg +4 | 2.0.90-6.el9_1 | ELSA-2023-1068 |
Advisories 7
- ALSA-2023:1068 Moderate: libjpeg-turbo security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2023:1068 Red Hat Security Advisory: libjpeg-turbo security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5631-1 libjpeg-turbo vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- RLSA-2023:1068 Moderate: libjpeg-turbo security update Rocky Linux Security Advisories · Feb 5, 2026
- WID-SEC-2023-0576 Red Hat Enterprise Linux (libjpeg-turbo): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 23, 2023
- ALAS2-2023-2214 Moderate: libjpeg-turbo security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 23, 2023
- ELSA-2023-1068 Moderate: libjpeg-turbo security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 6, 2023