{"cve":"CVE-2013-6629","nvd":{"published":"2013-11-19T04:50:56.250","modified":"2026-06-17T00:00:40.897","status":"Modified","description":"The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-200"],"references":["http://advisories.mageia.org/MGASA-2013-0333.html","http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html","http://bugs.ghostscript.com/show_bug.cgi?id=686980","http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705"],"products":["artifex:gpl_ghostscript","canonical:ubuntu_linux","debian:debian_linux","fedoraproject:fedora","google:chrome","libjpeg-turbo:libjpeg-turbo","mozilla:firefox","mozilla:seamonkey","mozilla:thunderbird","opensuse:opensuse","oracle:solaris"],"source":"nvd","synced_at":"2026-10-19T20:30:15.895642412+00:00"},"epss":{"cve":"CVE-2013-6629","score":0.0973,"percentile":0.95518,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}