In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain table pointers.

An update of the openjdk11 package has been released.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory.

    Aladdin Mubaied discovered that the cjpeg utility in libjpeg9 did not properly validate the input image's     size. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2016-3616)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled certain input. An attacker could     possibly use these issues to cause a denial of service. (CVE-2018-11212, CVE-2018-11813, CVE-2020-14152,     CVE-2020-14153)

    It was discovered that the cjpeg utility in libjpeg9 incorrectly handled memory when supplied with certain     input. An attacker could possibly use these issues to cause a denial of service or execute arbitrary code.
    (CVE-2018-11213, CVE-2018-11214)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204161	Photon OS 5.0: Openjdk11 PHSA-2023-5.0-0032	Nessus	PhotonOS Local Security Checks	high
203865	Photon OS 3.0: Openjdk11 PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	high
203528	Photon OS 4.0: Openjdk11 PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	high
195666	RHEL 5 : libjpeg (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
183713	Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2020-14153

high

Tenable Plugins

high

high

high

high

high