mozilla/mozjpeg

mozilla/mozjpeg

Releases68

Frequency5 months 3 weeks

Last Releasealmost 3 years ago

Stars5.69K

Improved JPEG encoder.

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2020-13790NVD↗	= 4.0.0	Jun 3, 2020Wednesday, 3 June 2020, 19:15	8.1 HIGH	5.8 MEDIUM
libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.
CVE-2018-14498NVD↗	<= 3.3.1	Mar 7, 2019Thursday, 7 March 2019, 23:29	—	4.3 MEDIUM
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
CVE-2017-15232NVD↗	—	Oct 11, 2017Wednesday, 11 October 2017, 03:29	—	4.3 MEDIUM
libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.