The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.(CVE-2016-3616)

A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.

CVE-2018-11212)

An out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11213)

An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11214)

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.(CVE-2018-14498)

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file.(CVE-2016-3616)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file.(CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file.(CVE-2018-11214)

  - heap-based buffer over-read via crafted 8-bit BMP in     get_8bit_row in rdbmp.c leads to denial of service     (CVE-2018-14498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libjpeg: NULL pointer dereference in cjpeg     (CVE-2016-3616)

  - libjpeg-turbo: heap-based buffer over-read via crafted     8-bit BMP in get_8bit_row in rdbmp.c leads to denial of     service (CVE-2018-14498)

  - libjpeg-turbo: Divide By Zero in alloc_sarray function     in jmemmgr.c (CVE-2018-11212)

  - libjpeg: Segmentation fault in get_text_gray_row     function in rdppm.c (CVE-2018-11213)

  - libjpeg: Segmentation fault in get_text_rgb_row function     in rdppm.c (CVE-2018-11214)

  - libjpeg: 'cjpeg' utility large loop because read_pixel     in rdtarga.c mishandles EOF (CVE-2018-11813)

An update for libjpeg-turbo is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.

Security Fix(es) :

* libjpeg: NULL pointer dereference in cjpeg (CVE-2016-3616)

* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

* libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)

* libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)

* libjpeg: 'cjpeg' utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5497-2 advisory.

    USN-5497-1 fixed vulnerabilities in Libjpeg6b. This update provides the corresponding updates for Ubuntu     16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been resolved in libjpeg-turbo, Debian's default JPEG implemenation.

CVE-2016-3616

The cjpeg utility in libjpeg allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

This issue got fixed by the same patch that fixed CVE-2018-11213 and CVE-2018-11214.

CVE-2018-1152

libjpeg-turbo has been found vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. The issue has been resolved by a boundary check.

CVE-2018-11212

The alloc_sarray function in jmemmgr.c allowed remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

The issue has been addressed by checking the image size when reading a targa file and throwing an error when image width or height is 0.

CVE-2018-11213 CVE-2018-11214

The get_text_gray_row and get_text_rgb_row functions in rdppm.c both allowed remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

By checking the range of integer values in PPM text files and adding checks to ensure values are within the specified range, both issues

For Debian 8 'Jessie', these problems have been fixed in version 1:1.3.1-12+deb8u1.

We recommend that you upgrade your libjpeg-turbo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to     cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11214)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2052 advisory.

    The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain     simple client programs for accessing the libjpeg functions. These packages provide the same functionality     and API as libjpeg but with better performance.

    Security Fix(es):

    * libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)

    * libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to     denial of service (CVE-2018-14498)

    * libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

    * libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)

    * libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)

    * libjpeg: cjpeg utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.(CVE-2016-3616)

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)

An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11214)

An out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11213)

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.(CVE-2018-14498)

A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.(CVE-2018-11212)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory.

    Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's     size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2016-3616)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could     possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152,     CVE-2020-14153)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain     input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code.
    (CVE-2018-11213, CVE-2018-11214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.10.9. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.10.9 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
130602	Amazon Linux 2 : libjpeg-turbo (ALAS-2019-1350)	Nessus	Amazon Linux Local Security Checks	2019/11/7	2024/4/15	high
130713	EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2019-2251)	Nessus	Huawei Local Security Checks	2019/11/8	2024/4/12	high
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	2022/9/1	2025/7/22	critical
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical
128231	Scientific Linux Security Update : libjpeg-turbo on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	2019/8/27	2024/5/1	high
128342	CentOS 7 : libjpeg-turbo (CESA-2019:2052)	Nessus	CentOS Local Security Checks	2019/8/30	2024/4/30	high
183718	Ubuntu 16.04 ESM : Libjpeg6b vulnerabilities (USN-5497-2)	Nessus	Ubuntu Local Security Checks	2023/10/23	2024/8/29	high
121315	Debian DLA-1638-1 : libjpeg-turbo security update	Nessus	Debian Local Security Checks	2019/1/23	2024/6/26	high
222043	Linux Distros Unpatched Vulnerability : CVE-2018-11214	Nessus	Misc.	2025/3/4	2026/7/12	medium
127661	RHEL 7 : libjpeg-turbo (RHSA-2019:2052)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/6	high
129013	Amazon Linux AMI : libjpeg-turbo (ALAS-2019-1286)	Nessus	Amazon Linux Local Security Checks	2019/9/19	2024/4/24	high
129912	NewStart CGSL CORE 5.04 / MAIN 5.04 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0185)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2024/4/18	high
132505	NewStart CGSL CORE 5.05 / MAIN 5.05 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0227)	Nessus	NewStart CGSL Local Security Checks	2019/12/31	2024/4/2	high
183713	Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)	Nessus	Ubuntu Local Security Checks	2023/10/23	2024/8/28	high
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	2022/9/1	2025/7/22	critical

检测

插件搜索

high

high

critical

critical

high

high

high

high

medium

high

high

high

high

high

critical