deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29228
Published: 2022-06-09
Description: Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions. continueDecoding() shouldn’t ever be called from filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-416
References: https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360; https://github.com/envoyproxy/envoy/security/advisories/GHSA-rww6-8h7g-8jf6; https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360
CVE: CVE-2022-29250
Published: 2022-06-09
Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw; https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw
CVE: CVE-2022-31033
Published: 2022-06-09
Description: The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317; https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX/
CVE: CVE-2022-31051
Published: 2022-06-09
Description: semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by `encodeURI`. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL are already masked properly.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI; https://github.com/semantic-release/semantic-release/commit/58a226f29c04ee56bbb02cc661f020d568849cad; https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3
CVE: CVE-2022-21499
Published: 2022-06-09
Description: KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/168191/Kernel-Live-Patch-Security-Notice-LSN-0089-1.html; https://git.kernel.org/linus/eadb2f47a3ced5c64b23b90fd2a3463f63726066; https://www.debian.org/security/2022/dsa-5161
CVE: CVE-2022-30702
Published: 2022-06-09
Description: Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow an attacker to disclose sensitive information on an affected machine.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11022; https://www.zerodayinitiative.com/advisories/ZDI-22-800/; https://helpcenter.trendmicro.com/en-us/article/tmka-11022
CVE: CVE-2022-30703
Published: 2022-06-09
Description: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leaked kernel addresses and disclose sensitive information. This vulnerability could also potentially be chained for privilege escalation.
CVSS Score: 7.8 (HIGH)
References: https://helpcenter.trendmicro.com/en-us/article/tmka-11021; https://www.zerodayinitiative.com/advisories/ZDI-22-801/; https://helpcenter.trendmicro.com/en-us/article/tmka-11021
CVE: CVE-2022-31045
Published: 2022-06-09
Description: Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-125
References: https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x; https://istio.io/latest/news/security/istio-security-2022-05; https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
CVE: CVE-2017-20018
Published: 2022-06-09
Description: A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipulation leads to privilege escalation. It is possible to launch the attack remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://packetstormsecurity.com/files/142406/xampp-dllhijack.txt; https://vuldb.com/?id.100950; https://packetstormsecurity.com/files/142406/xampp-dllhijack.txt
CVE: CVE-2017-20019
Published: 2022-06-09
Description: A vulnerability classified as problematic was found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this vulnerability is an unknown functionality of the component Config Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98929; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20020
Published: 2022-06-09
Description: A vulnerability, which was classified as problematic, has been found in Solare Solar-Log 2.8.4-56/3.5.2-85. Affected by this issue is some unknown functionality. The manipulation leads to cross site request forgery. The attack may be launched remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98930; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20021
Published: 2022-06-09
Description: A vulnerability, which was classified as critical, was found in Solare Solar-Log 2.8.4-56/3.5.2-85. This affects an unknown part of the component File Upload. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-434
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98931; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20022
Published: 2022-06-09
Description: A vulnerability has been found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98932; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20023
Published: 2022-06-09
Description: A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85 and classified as critical. This issue affects some unknown processing of the component Network Config. The manipulation leads to privilege escalation. The attack may be initiated remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98933; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20024
Published: 2022-06-09
Description: A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98934; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20025
Published: 2022-06-09
Description: A vulnerability was found in Solare Solar-Log 2.8.4-56/3.5.2-85. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Flash Memory. The manipulation leads to privilege escalation. The attack can be launched remotely. Upgrading to version 3.5.3-86 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: http://seclists.org/fulldisclosure/2017/Mar/58; https://vuldb.com/?id.98935; http://seclists.org/fulldisclosure/2017/Mar/58
CVE: CVE-2017-20026
Published: 2022-06-09
Description: A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting (Reflected). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/47; https://vuldb.com/?id.98923; http://seclists.org/fulldisclosure/2017/Mar/47
CVE: CVE-2017-20027
Published: 2022-06-09
Description: A vulnerability was found in HumHub up to 1.0.1 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting (DOM). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/47; https://vuldb.com/?id.98924; http://seclists.org/fulldisclosure/2017/Mar/47
CVE: CVE-2017-20028
Published: 2022-06-09
Description: A vulnerability was found in HumHub 0.20.1/1.0.0-beta.3. It has been classified as critical. This affects an unknown part. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-269, CWE-269
References: http://seclists.org/fulldisclosure/2017/Mar/48; https://vuldb.com/?id.98925; http://seclists.org/fulldisclosure/2017/Mar/48
CVE: CVE-2022-31042
Published: 2022-06-10
Description: Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach to use your own redirect middleware, rather than ours. If you do not require or expect redirects to be followed, one should simply disable redirects all together.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-212
References: https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8; https://github.com/guzzle/guzzle/security/advisories/GHSA-f2wf-25xc-69c9; https://www.debian.org/security/2022/dsa-5246
CVE: CVE-2022-31043
Published: 2022-06-10
Description: Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. Users unable to upgrade may consider an alternative approach which would be to use their own redirect middleware. Alternately users may simply disable redirects all together if redirects are not expected or required.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-212
References: https://github.com/guzzle/guzzle/commit/e3ff079b22820c2029d4c2a87796b6a0b8716ad8; https://github.com/guzzle/guzzle/security/advisories/GHSA-w248-ffj2-4v5q; https://www.debian.org/security/2022/dsa-5246
CVE: CVE-2017-20029
Published: 2022-06-10
Description: A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89, CWE-89
References: http://seclists.org/fulldisclosure/2017/Mar/45; https://vuldb.com/?id.98915; http://seclists.org/fulldisclosure/2017/Mar/45
CVE: CVE-2017-20030
Published: 2022-06-10
Description: A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://seclists.org/fulldisclosure/2017/Mar/45; https://vuldb.com/?id.98916; http://seclists.org/fulldisclosure/2017/Mar/45
CVE: CVE-2017-20031
Published: 2022-06-10
Description: A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument sortby with the input password leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2017/Mar/45; https://vuldb.com/?id.98917; http://seclists.org/fulldisclosure/2017/Mar/45
CVE: CVE-2017-20032
Published: 2022-06-10
Description: A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: http://seclists.org/fulldisclosure/2017/Mar/45; https://vuldb.com/?id.98918; http://seclists.org/fulldisclosure/2017/Mar/45
CVE: CVE-2017-20033
Published: 2022-06-10
Description: A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";><script>alert(8)</script> leads to cross site scripting (Reflected). It is possible to initiate the attack remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/46; https://vuldb.com/?id.98919; http://seclists.org/fulldisclosure/2017/Mar/46
CVE: CVE-2017-20034
Published: 2022-06-10
Description: A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting (Persistent). The attack can be initiated remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/46; https://vuldb.com/?id.98920; http://seclists.org/fulldisclosure/2017/Mar/46
CVE: CVE-2017-20035
Published: 2022-06-10
Description: A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation leads to cross site scripting (Persistent). The attack may be initiated remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/46; https://vuldb.com/?id.98921; http://seclists.org/fulldisclosure/2017/Mar/46
CVE: CVE-2017-20036
Published: 2022-06-10
Description: A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bounce Rule. The manipulation leads to cross site scripting (Persistent). It is possible to launch the attack remotely. Upgrading to version 3.3.1 is able to address this issue. It is recommended to upgrade the affected component.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: http://seclists.org/fulldisclosure/2017/Mar/46; https://vuldb.com/?id.98922; http://seclists.org/fulldisclosure/2017/Mar/46
CVE: CVE-2021-42811
Published: 2022-06-10
Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SafeNet KeySecure allows an authenticated user to read arbitrary files from the underlying system on which the product is deployed.
CVSS Score: 3.3 (LOW)
CWE: CWE-22, CWE-22
References: https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=9278cada973f45509fd638d3f153afff&sysparm_article=KB0025953; https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=9278cada973f45509fd638d3f153afff&sysparm_article=KB0025953
CVE: CVE-2022-32563
Published: 2022-06-10
Description: An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2. Admin credentials are not verified when using X.509 client-certificate authentication from Sync Gateway to Couchbase Server. When Sync Gateway is configured to authenticate with Couchbase Server using X.509 client certificates, the admin credentials provided to the Admin REST API are ignored, resulting in privilege escalation for unauthenticated users. The Public REST API is not impacted by this issue. A workaround is to replace X.509 certificate based authentication with Username and Password authentication inside the bootstrap configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: https://forums.couchbase.com/tags/security; https://www.couchbase.com/alerts; https://forums.couchbase.com/tags/security
CVE: CVE-2021-44117
Published: 2022-06-10
Description: A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/warmachine-57/CVE-2021-44117/blob/main/CSRF%20in%20FuelCMS; https://www.getfuelcms.com/; https://github.com/warmachine-57/CVE-2021-44117/blob/main/CSRF%20in%20FuelCMS
CVE: CVE-2021-44582
Published: 2022-06-10
Description: A Privilege Escalation vulnerability exists in Sourcecodester Money Transfer Management System 1.0, which allows a remote malicious user to gain elevated privileges to the Admin role via any URL.
CVSS Score: 8.8 (HIGH)
CWE: CWE-425
References: https://github.com/warmachine-57/CVE-2021-44582/blob/main/Privilege%20Escalation%20via%20Forced%20Browsing%20in%20Sourcecodester%20Money%20Transfer%20Management%20System; https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html; https://github.com/warmachine-57/CVE-2021-44582/blob/main/Privilege%20Escalation%20via%20Forced%20Browsing%20in%20Sourcecodester%20Money%20Transfer%20Management%20System
CVE: CVE-2022-27502
Published: 2022-06-10
Description: RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operation executes %TEMP% files as SYSTEM.
CVSS Score: 7.8 (HIGH)
References: https://help.realvnc.com/hc/en-us/articles/[PII_REDACTED]11-Are-there-any-known-security-vulnerabilities-#cve-2008-4770-moderate-%E2%80%94-only-affects-vnc-viewer--0-1; https://realvnc.com; https://help.realvnc.com/hc/en-us/articles/[PII_REDACTED]11-Are-there-any-known-security-vulnerabilities-#cve-2008-4770-moderate-%E2%80%94-only-affects-vnc-viewer--0-1
CVE: CVE-2022-31788
Published: 2022-06-10
Description: IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/RNPG/b154f4b2e90340d2f39605989af06bee; https://gist.github.com/This-is-Neo/cc5b08ad8a3a60cd81fd1b9c1cb573b4; https://gist.github.com/RNPG/b154f4b2e90340d2f39605989af06bee
CVE: CVE-2022-32978
Published: 2022-06-10
Description: There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS scan.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/thorfdbg/libjpeg/commit/4746b577931e926a49e50de9720a4946de3069a7; https://github.com/thorfdbg/libjpeg/issues/75; https://github.com/thorfdbg/libjpeg/commit/4746b577931e926a49e50de9720a4946de3069a7