The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

An update of the libjpeg package has been released.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)

  - An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote     attackers to cause a denial of service (divide-by-zero error) via a crafted file. (CVE-2018-11212)

  - An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers     to cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11213)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)

  - An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote     attackers to cause a denial of service (divide-by-zero error) via a crafted file. (CVE-2018-11212)

  - An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers     to cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11213)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory.

    Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's     size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2016-3616)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could     possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152,     CVE-2020-14153)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain     input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code.
    (CVE-2018-11213, CVE-2018-11214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2052 advisory.

    - Fix CVE-2018-14498 (#1687475)
    - Fix CVE-2018-11212 (#1586062)
    - Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091)       and CVE-2018-11214 (#1589110)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file.(CVE-2016-3616)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries.(CVE-2018-14498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file.(CVE-2016-3616)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file.(CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file.(CVE-2018-11214)

  - heap-based buffer over-read via crafted 8-bit BMP in     get_8bit_row in rdbmp.c leads to denial of service     (CVE-2018-14498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.(CVE-2016-3616)

A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.

CVE-2018-11212)

An out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11213)

An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11214)

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.(CVE-2018-14498)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.(CVE-2016-3616)

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)

An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11214)

An out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11213)

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.(CVE-2018-14498)

A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.(CVE-2018-11212)

An update for libjpeg-turbo is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.

Security Fix(es) :

* libjpeg: NULL pointer dereference in cjpeg (CVE-2016-3616)

* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)

* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

* libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)

* libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)

* libjpeg: 'cjpeg' utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - libjpeg: NULL pointer dereference in cjpeg     (CVE-2016-3616)

  - libjpeg-turbo: heap-based buffer over-read via crafted     8-bit BMP in get_8bit_row in rdbmp.c leads to denial of     service (CVE-2018-14498)

  - libjpeg-turbo: Divide By Zero in alloc_sarray function     in jmemmgr.c (CVE-2018-11212)

  - libjpeg: Segmentation fault in get_text_gray_row     function in rdppm.c (CVE-2018-11213)

  - libjpeg: Segmentation fault in get_text_rgb_row function     in rdppm.c (CVE-2018-11214)

  - libjpeg: 'cjpeg' utility large loop because read_pixel     in rdtarga.c mishandles EOF (CVE-2018-11813)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2052 advisory.

    The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain     simple client programs for accessing the libjpeg functions. These packages provide the same functionality     and API as libjpeg but with better performance.

    Security Fix(es):

    * libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)

    * libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to     denial of service (CVE-2018-14498)

    * libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)

    * libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)

    * libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)

    * libjpeg: cjpeg utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The libjpeg-turbo package contains a library of     functions for manipulating JPEG images.Security     Fix(es):A divide by zero vulnerability has been     discovered in libjpeg-turbo in alloc_sarray function of     jmemmgr.c file. An attacker could use this     vulnerability to cause a denial of service via a     crafted file.(CVE-2018-11212)The cjpeg utility in     libjpeg allows remote attackers to cause a denial of     service (NULL pointer dereference and application     crash) or execute arbitrary code via a crafted     file.(CVE-2016-3616)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been resolved in libjpeg-turbo, Debian's default JPEG implemenation.

CVE-2016-3616

The cjpeg utility in libjpeg allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

This issue got fixed by the same patch that fixed CVE-2018-11213 and CVE-2018-11214.

CVE-2018-1152

libjpeg-turbo has been found vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. The issue has been resolved by a boundary check.

CVE-2018-11212

The alloc_sarray function in jmemmgr.c allowed remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

The issue has been addressed by checking the image size when reading a targa file and throwing an error when image width or height is 0.

CVE-2018-11213 CVE-2018-11214

The get_text_gray_row and get_text_rgb_row functions in rdppm.c both allowed remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

By checking the range of integer values in PPM text files and adding checks to ensure values are within the specified range, both issues

For Debian 8 'Jessie', these problems have been fixed in version 1:1.3.1-12+deb8u1.

We recommend that you upgrade your libjpeg-turbo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3706-1 advisory.

    It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or     automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause     libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202903	Photon OS 1.0: Libjpeg PHSA-2020-1.0-0327	Nessus	PhotonOS Local Security Checks	high
199454	RHEL 7 : libjpeg (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199440	RHEL 6 : libjpeg (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199433	RHEL 5 : libjpeg (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195666	RHEL 5 : libjpeg (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195619	RHEL 6 : libjpeg (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195607	RHEL 7 : libjpeg (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
183713	Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)	Nessus	Ubuntu Local Security Checks	high
180767	Oracle Linux 7 : libjpeg-turbo (ELSA-2019-2052)	Nessus	Oracle Linux Local Security Checks	high
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	critical
132505	NewStart CGSL CORE 5.05 / MAIN 5.05 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0227)	Nessus	NewStart CGSL Local Security Checks	high
131899	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2019-2407)	Nessus	Huawei Local Security Checks	high
130713	EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2019-2251)	Nessus	Huawei Local Security Checks	high
130602	Amazon Linux 2 : libjpeg-turbo (ALAS-2019-1350)	Nessus	Amazon Linux Local Security Checks	high
129912	NewStart CGSL CORE 5.04 / MAIN 5.04 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0185)	Nessus	NewStart CGSL Local Security Checks	high
129013	Amazon Linux AMI : libjpeg-turbo (ALAS-2019-1286)	Nessus	Amazon Linux Local Security Checks	high
128342	CentOS 7 : libjpeg-turbo (CESA-2019:2052)	Nessus	CentOS Local Security Checks	high
128231	Scientific Linux Security Update : libjpeg-turbo on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	high
127661	RHEL 7 : libjpeg-turbo (RHSA-2019:2052)	Nessus	Red Hat Local Security Checks	high
125580	EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2019-1628)	Nessus	Huawei Local Security Checks	high
121315	Debian DLA-1638-1 : libjpeg-turbo security update	Nessus	Debian Local Security Checks	high
110973	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libjpeg-turbo vulnerabilities (USN-3706-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-3616

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high