Is CVE-2013-6629 being actively exploited?

CVE-2013-6629 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2013-6629?

CVE-2013-6629 has a CVSS 2.0 base score of 5.0 (MEDIUM).

CVE-2013-6629

MEDIUM · CVSS 5.0EPSS 9.7%EU EUVD

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

Key facts

CVSS score: 5.0 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness (CWE): CWE-200
EPSS score: 9.7% (96th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2013-6431)
Published: November 19, 2013
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2013-6431 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.

View on the EU Vulnerability Database

Affected products

artifex / gpl ghostscript
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora
fedoraproject / fedora
google / chrome
libjpeg-turbo / libjpeg-turbo
mozilla / firefox
mozilla / seamonkey
mozilla / thunderbird
opensuse / opensuse
opensuse / opensuse
opensuse / opensuse
oracle / solaris

References

http://advisories.mageia.org/MGASA-2013-0333.html(Third Party Advisory)
http://archives.neohapsis.com/archives/fulldisclosure/2013-11/0080.html(Broken Link)
http://bugs.ghostscript.com/show_bug.cgi?id=686980(Issue Tracking, Vendor Advisory)
http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html(Vendor Advisory)
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705(Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html(Mailing List, Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html(Mailing List, Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html(Mailing List, Third Party Advisory)
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00025.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00026.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00002.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html(Mailing List, Third Party Advisory)
http://marc.info/?l=bugtraq&m=140852886808946&w=2(Issue Tracking, Mailing List, Third Party Advisory)
http://marc.info/?l=bugtraq&m=140852974709252&w=2(Issue Tracking, Mailing List, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-1803.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2013-1804.html(Third Party Advisory)
http://secunia.com/advisories/56175(Not Applicable)
http://secunia.com/advisories/58974(Not Applicable)
http://secunia.com/advisories/59058(Not Applicable)
http://security.gentoo.org/glsa/glsa-201406-32.xml(Third Party Advisory)
http://support.apple.com/kb/HT6150(Third Party Advisory)
http://support.apple.com/kb/HT6162(Third Party Advisory)
http://support.apple.com/kb/HT6163(Third Party Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg21672080(Third Party Advisory)
http://www-01.ibm.com/support/docview.wss?uid=swg21676746(Broken Link)
http://www.debian.org/security/2013/dsa-2799(Third Party Advisory)
http://www.mandriva.com/security/advisories?name=MDVSA-2013:273(Broken Link)
http://www.mozilla.org/security/announce/2013/mfsa2013-116.html(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html(Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html(Third Party Advisory)
http://www.securityfocus.com/bid/63676(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1029470(Broken Link, Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain