CVE-2022-37768: 
Linux Debian vulnerability analysis and mitigation

libjpeg commit 281daa9 was discovered to contain an infinite loop vulnerability via the component Frame::ParseTrailer. The vulnerability was assigned CVE-2022-37768 and was disclosed on August 18, 2022. The vulnerability affects libjpeg software, particularly versions before commit 281daa9 (NVD, CVE).

The vulnerability exists in the Frame::ParseTrailer function where there is a continuous loop that reads markers in the stream by calling IOStream::PeekWord() function. The issue occurs because IOStream::PeekWord() might always return the same value, causing the program to repeatedly read values from the same address. This results in the program never terminating as it continuously takes the default branch in the code. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub Issue).

The vulnerability allows attackers to cause a Denial of Service (DoS) condition by triggering an infinite loop in the application. This can result in the program never terminating, effectively making the service unavailable (NVD).

The vulnerability has been fixed in newer versions of libjpeg. Debian has addressed this in version 0.0~git20220805.54ec643-1 and later releases. Users are advised to upgrade to the fixed versions to mitigate this vulnerability (Debian Tracker).