libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libjpeg-turbo: Invalid memory access in the fill_input_buffer function (CVE-2017-9614)

  - libjpeg-turbo: several integer overflows and subsequent segfaults when attempting to compress/decompress     gigapixel images (CVE-2019-2201)

  - libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG     file, related to the Exif marker. (CVE-2014-9092)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libjpeg-turbo: Invalid memory access in the fill_input_buffer function (CVE-2017-9614)

  - libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG     file, related to the Exif marker. (CVE-2014-9092)

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.
    (CVE-2017-15232)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the version of the libjpeg-turbo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The libjpeg-turbo package contains a library of     functions for manipulatingJPEG images.Security     Fix(es):libjpeg-turbo 1.5.2 has a NULL Pointer     Dereference in jdpostct.c and jquant1.c via a crafted     JPEG file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In generate_jsimd_ycc_rgb_convert_neon of     jsimd_arm64_neon.S, there is a possible out of bounds     write due to a missing bounds check. This could lead to     remote code execution in an unprivileged process with     no additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-8.0 Android-8.1 Android-9     Android-10Android ID: A-120551338(CVE-2019-2201)

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

  - libjpeg-turbo before 1.3.1 allows remote attackers to     cause a denial of service (crash) via a crafted JPEG     file, related to the Exif marker.(CVE-2014-9092)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libjpeg package has been released.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3706-1 advisory.

    It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or     automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause     libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for jpeg fixes the following issues :

  - CVE-2017-15232: NULL pointer dereferences in jdpostct.c     and jquant1.c could lead to denial of service (crash)     when processing images [bsc#1062937]

  - CVE-2018-11813: Fixed the end-of-file mishandling in     read_pixel in rdtarga.c, which allowed remote attackers     to cause a denial-of-service via crafted JPG files due     to a large loop [bsc#1096209]

  - CVE-2018-1152: Fixed a denial of service in     start_input_bmp() rdbmp.c caused by a divide by zero     when processing a crafted BMP image [bsc#1098155]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libjpeg-turbo fixes the following security issue :

  - CVE-2017-15232: Fix NULL pointer dereference in     jdpostct.c and jquant1.c - additional fixes     (bsc#1062937)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libjpeg-turbo fixes the following issues: Feature update :

  - Update from version 1.3.1 to version 1.5.2     (fate#324061). Security issue fixed :

  - CVE-2017-15232: Fix NULL pointer dereference in     jdpostct.c and jquant1.c (bsc#1062937).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libjpeg-turbo to version 1.5.2 fixes the following issues :

  - CVE-2017-15232: NULL pointer dereference in jdpostct.c     and jquant1.c (boo#1062937)

This compatible version update contains the following improvements :

  - Improved and updated upsampling support and sampling     factors

  - Memory handling correctness fixes

  - Improved robustness when decoding images

This version is a dependency of Chromium 62.

ID	Name	Product	Family	Severity
200025	RHEL 7 : libjpeg-turbo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199984	RHEL 6 : libjpeg-turbo (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196371	RHEL 7 : libjpeg-turbo (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196313	RHEL 6 : libjpeg-turbo (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
151894	EulerOS Virtualization 3.0.2.2 : libjpeg-turbo (EulerOS-SA-2021-2144)	Nessus	Huawei Local Security Checks	medium
151311	EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2021-2093)	Nessus	Huawei Local Security Checks	medium
147114	EulerOS Virtualization 3.0.6.6 : libjpeg-turbo (EulerOS-SA-2021-1489)	Nessus	Huawei Local Security Checks	high
146708	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2021-1316)	Nessus	Huawei Local Security Checks	medium
146153	EulerOS 2.0 SP5 : libjpeg-turbo (EulerOS-SA-2021-1202)	Nessus	Huawei Local Security Checks	medium
135531	EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2020-1402)	Nessus	Huawei Local Security Checks	medium
121789	Photon OS 2.0: Libjpeg PHSA-2017-2.0-0007	Nessus	PhotonOS Local Security Checks	medium
110973	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libjpeg-turbo vulnerabilities (USN-3706-1)	Nessus	Ubuntu Local Security Checks	high
110762	SUSE SLES11 Security Update : jpeg (SUSE-SU-2018:1825-1)	Nessus	SuSE Local Security Checks	high
106665	openSUSE Security Update : libjpeg-turbo (openSUSE-2018-141)	Nessus	SuSE Local Security Checks	medium
106653	SUSE SLED12 / SLES12 Security Update : libjpeg-turbo (SUSE-SU-2018:0373-1)	Nessus	SuSE Local Security Checks	medium
104243	openSUSE Security Update : libjpeg-turbo (openSUSE-2017-1218)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2017-15232

medium

Tenable Plugins

high

high

high

high

medium

medium

high

medium

medium

medium

medium

high

high

medium

medium

medium