In IJG JPEG (aka libjpeg) before 9d, jdhuff.c has an out-of-bounds array read for certain table pointers. References: https://bugs.gentoo.org/727908 http://www.ijg.org/files/jpegsrc.v9d.tar.gz
External References: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/445
Statement: Red Hat Enterprise Linux 6 and further versions ships libjpeg-turbo which already contains the fixes, thus these products are not affected.