The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2052 advisory.

    - Fix CVE-2018-14498 (#1687475)
    - Fix CVE-2018-11212 (#1586062)
    - Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091)       and CVE-2018-11214 (#1589110)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4124:02 advisory.

    * libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)
      * libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to     denial of service (CVE-2018-14498)
      * libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)
      * libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)
      * libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)
      * libjpeg: cjpeg utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The libjpeg-turbo package contains a library of     functions for manipulating JPEG images.Security     Fix(es):A divide by zero vulnerability has been     discovered in libjpeg-turbo in alloc_sarray function of     jmemmgr.c file. An attacker could use this     vulnerability to cause a denial of service via a     crafted file.(CVE-2018-11212)The cjpeg utility in     libjpeg allows remote attackers to cause a denial of     service (NULL pointer dereference and application     crash) or execute arbitrary code via a crafted     file.(CVE-2016-3616)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file.(CVE-2016-3616)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file.(CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file.(CVE-2018-11214)

  - heap-based buffer over-read via crafted 8-bit BMP in     get_8bit_row in rdbmp.c leads to denial of service     (CVE-2018-14498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libjpeg: NULL pointer dereference in cjpeg     (CVE-2016-3616)

  - libjpeg-turbo: heap-based buffer over-read via crafted     8-bit BMP in get_8bit_row in rdbmp.c leads to denial of     service (CVE-2018-14498)

  - libjpeg-turbo: Divide By Zero in alloc_sarray function     in jmemmgr.c (CVE-2018-11212)

  - libjpeg: Segmentation fault in get_text_gray_row     function in rdppm.c (CVE-2018-11213)

  - libjpeg: Segmentation fault in get_text_rgb_row function     in rdppm.c (CVE-2018-11214)

  - libjpeg: 'cjpeg' utility large loop because read_pixel     in rdtarga.c mishandles EOF (CVE-2018-11813)

An update for libjpeg-turbo is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.

Security Fix(es) :

* libjpeg: NULL pointer dereference in cjpeg (CVE-2016-3616)

* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

* libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)

* libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)

* libjpeg: 'cjpeg' utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

An update of the libjpeg package has been released.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2052 advisory.

    The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain     simple client programs for accessing the libjpeg functions. These packages provide the same functionality     and API as libjpeg but with better performance.

    Security Fix(es):

    * libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)

    * libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to     denial of service (CVE-2018-14498)

    * libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

    * libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)

    * libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)

    * libjpeg: cjpeg utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.(CVE-2016-3616)

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)

An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11214)

An out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11213)

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.(CVE-2018-14498)

A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.(CVE-2018-11212)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.10.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10.9 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory.

    Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's     size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2016-3616)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could     possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152,     CVE-2020-14153)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain     input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code.
    (CVE-2018-11213, CVE-2018-11214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
180767	Oracle Linux 7 : libjpeg-turbo (ELSA-2019-2052)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
289065	MiracleLinux 7 : libjpeg-turbo-1.2.90-8.el7 (AXSA:2019-4124:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
125580	EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2019-1628)	Nessus	Huawei Local Security Checks	2019/5/30	2024/5/17	high
130713	EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2019-2251)	Nessus	Huawei Local Security Checks	2019/11/8	2024/4/12	high
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical
128231	Scientific Linux Security Update : libjpeg-turbo on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	high
128342	CentOS 7 : libjpeg-turbo (CESA-2019:2052)	Nessus	CentOS Local Security Checks	2019/8/30	2024/4/30	high
202903	Photon OS 1.0: Libjpeg PHSA-2020-1.0-0327	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/22	high
127661	RHEL 7 : libjpeg-turbo (RHSA-2019:2052)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	high
129013	Amazon Linux AMI : libjpeg-turbo (ALAS-2019-1286)	Nessus	Amazon Linux Local Security Checks	2019/9/19	2024/4/24	high
129912	NewStart CGSL CORE 5.04 / MAIN 5.04 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0185)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2024/4/18	high
132505	NewStart CGSL CORE 5.05 / MAIN 5.05 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0227)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2024/4/2	high
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	2022/9/1	2025/7/22	critical
183713	Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)	Nessus	Ubuntu Local Security Checks	2023/10/23	2024/8/28	high

检测

插件搜索

high

high

high

high

critical

critical

high

high

high

high

high

high

high

critical

high