CVE-2013-6629: Artifex Gpl Ghostscript

Medium severity, CVSS 5.0. EPSS: 9.7% chance of exploitation in the next 30 days.

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

Affected products

• Artifex Gpl Ghostscript: before 9.03 (fixed in 9.03)
• Canonical Ubuntu Linux: version 10.04 only; version 12.04 only; version 12.10 only; version 13.04 only; version 13.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only
• Fedoraproject Fedora: version 18 only; version 19 only; version 20 only
• Google Chrome: before 31.0.1650.48 (fixed in 31.0.1650.48)
• Libjpeg-Turbo Libjpeg-Turbo: before 1.3.1 (fixed in 1.3.1)
• Mozilla Firefox: before 24.2 (fixed in 24.2); before 26.0 (fixed in 26.0)
• Mozilla Seamonkey: before 2.23 (fixed in 2.23)
• Mozilla Thunderbird: before 24.2.0 (fixed in 24.2.0)
• Opensuse Opensuse: version 12.2 only; version 12.3 only; version 13.1 only
• Oracle Solaris: version 11.3 only

Published 2013-11-19. Last modified 2026-06-17.