CVE-2020-14152

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.ijg.org/files/jpegsrc.v9d.tar.gzProduct
https://bugs.gentoo.org/727908Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00033.htmlMailing List, Third Party Advisory
http://www.ijg.org/files/jpegsrc.v9d.tar.gzProduct
https://bugs.gentoo.org/727908Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00033.htmlMailing List, Third Party Advisory

Timeline

Published: Jun 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-141537.1In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.CVE-2020-141544.8Mutt before 1.14.3 proceeds with a connection even if, in response to a GnuTLS certificate prompt, the user rejects an expired intermediate CVE-2020-141555.3libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.CVE-2020-141568.8user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions CVE-2020-141578.1The wireless-communication feature of the ABUS Secvest FUBE50001 device does not encrypt sensitive data such as PIN codes or IDs of used pro CVE-2020-141589.1The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that a CVE-2020-141598.8By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications CVE-2020-14168.8An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Stu CVE-2020-141607.5An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able t CVE-2020-141616.1It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.CVE-2020-141627.8An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root withou CVE-2020-141637.5An issue was discovered in ecma/operations/ecma-container-object.c in JerryScript 2.2.0. Operations with key/value pairs did not consider th