This is probably another instance of CVE-2013-6629, reference:

http://seclists.org/fulldisclosure/2013/Nov/83

A SWF to reproduce is attached, along with source. To reproduce, host JPEGLeak.swf on the same web server / directory as 55.jpg.

Since this is uninitialized data, you can reload the SWF and see the rendered JPEG change either slightly or sometimes dramatically. It seems to work best with a Flash process that is not fresh. A couple of screenshots are attached to illustrate that the rendered images can sometimes differ significantly. The SWF file also demonstrates that the uninitialized data can be leaked to script, which makes the issue interesting / more serious.

If this is indeed the same underlying issue as CVE-2013-6629, then this patch may be useful:

http://src.chromium.org/viewvc/chrome/trunk/src/third_party/libjpeg/jdmarker.c?r1=228354&r2=228353&pathrev=228354
 

	flashcorrupt1.png 8.4 KB View Download

	55.jpg 642 bytes View Download

JPEGLeak.swf 1004 bytes Download

JPEGLeak.as 1.2 KB Download

	flashcorrupt2.png 6.0 KB View Download