遠端 Ubuntu 18.04 LTS/20.04 LTS 主機上安裝的套件受到 USN-5631-1 公告中所提及的多個弱點影響。

  - 由於 rdtrga.c 中的 read_pixel 不當處理 EOF，導致 libjpeg 9c 產生大型迴圈。(CVE-2018-11813)

  - Libjpeg-turbo 所有版本在轉換組件中都存在堆疊型緩衝區溢位問題。遠端攻擊者可將格式錯誤的 jpeg 檔案傳送至服務，並造成目標服務的任意程式碼執行或拒絕服務。(CVE-2020-17541)

  - 當 libjpeg-turbo 處理特製的輸入檔案時，jcopy_sample_rows() 中會發生 null 指標解除參照。(CVE-2020-35538)

  - 在 libjpeg-turbo 2.0.90 以及之前的所有版本中，PPM 讀取器未正確處理使用 tjLoadImage 將 16 位元二進位 PPM 檔案載入至 grayscale 緩衝區，以及將 16 位元二進位 PGM 檔案載入至 RGB 緩衝區。這與 rdppm.c 中 get_word_rgb_row 函式的堆積型緩衝區溢位爲題有關。(CVE-2021-46822)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Libjpeg-turbo 所有版本在轉換組件中都存在堆疊型緩衝區溢位問題。遠端攻擊者可將格式錯誤的 jpeg 檔案傳送至服務，並造成目標服務的任意程式碼執行或拒絕服務。(CVE-2020-17541)

請注意，Nessus 依賴供應商報告的套件存在。

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libjpeg-turbo all version have a stack-based buffer overflow in the 'transform' component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Libjpeg-turbo all version have a stack-based buffer overflow in the 'transform' component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libjpeg-turbo all version have a stack-based buffer     overflow in the 'transform' component. A remote     attacker can send a malformed jpeg file to the service     and cause arbitrary code execution or denial of service     of the target service.(CVE-2020-17541)

  - In IJG JPEG (aka libjpeg) before 9d,     jpeg_mem_available() in jmemnobs.c in djpeg does not     honor the max_memory_to_use setting, possibly causing     excessive memory consumption.(CVE-2020-14152)

  - In generate_jsimd_ycc_rgb_convert_neon of     jsimd_arm64_neon.S, there is a possible out of bounds     write due to a missing bounds check. This could lead to     remote code execution in an unprivileged process with     no additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-8.0 Android-8.1 Android-9     Android-10Android ID: A-120551338(CVE-2019-2201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4288 advisory.

    [1.5.3-12]
    - Add missing license file (#1982572)

    [1.5.3-11]
    - Fix CVE-2020-17541 (#1972289)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libjpeg package has been released.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0892-1 advisory.

  - Libjpeg-turbo all version have a stack-based buffer overflow in the transform component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4288 advisory.

  - Libjpeg-turbo all version have a stack-based buffer overflow in the transform component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5553-1 advisory.

    It was discovered that libjpeg-turbo was not properly handling EOF characters, which could lead to     excessive memory consumption through the execution of a large loop. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-11813)

    It was discovered that libjpeg-turbo was not properly performing bounds check operations, which could lead     to a heap-based buffer overread. If a user or automated system were tricked into opening a specially     crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only     affected Ubuntu 14.04 ESM. (CVE-2018-14498)

    It was discovered that libjpeg-turbo was not properly limiting the amount of main memory being consumed by     the system during decompression or multi-pass compression operations, which could lead to excessive memory     consumption. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-14152)

    It was discovered that libjpeg-turbo was not properly setting variable sizes when performing certain kinds     of encoding operations, which could lead to a stack-based buffer overflow. If a user or automated system     were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a     denial of service. (CVE-2020-17541)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165321	Ubuntu 18.04 LTS / 20.04 LTS：libjpeg-turbo 弱點 (USN-5631-1)	Nessus	Ubuntu Local Security Checks	2022/9/22	2025/9/3	high
223441	Linux Distros 未修補弱點：CVE-2020-17541	Nessus	Misc.	2025/3/4	2025/9/3	high
153638	EulerOS 2.0 SP8 : libjpeg-turbo (EulerOS-SA-2021-2470)	Nessus	Huawei Local Security Checks	2021/9/24	2023/11/29	high
157969	EulerOS Virtualization 3.0.6.0 : libjpeg-turbo (EulerOS-SA-2022-1075)	Nessus	Huawei Local Security Checks	2022/2/12	2023/11/9	high
153340	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2021-2396)	Nessus	Huawei Local Security Checks	2021/9/14	2023/11/30	high
155413	Oracle Linux 8 : libjpeg-turbo (ELSA-2021-4288)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/11/2	high
150931	Photon OS 2.0: Libjpeg PHSA-2021-2.0-0358	Nessus	PhotonOS Local Security Checks	2021/6/21	2024/7/23	high
151081	openSUSE 15 Security Update : libjpeg-turbo (openSUSE-SU-2021:0892-1)	Nessus	SuSE Local Security Checks	2021/6/28	2023/12/12	high
184751	Rocky Linux 8 : libjpeg-turbo (RLSA-2021:4288)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high
163922	Ubuntu 16.04 ESM : libjpeg-turbo vulnerabilities (USN-5553-1)	Nessus	Ubuntu Local Security Checks	2022/8/9	2025/9/3	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high