CVE-2018-11214: Medium severity IJG libjpeg vulnerability
An issue was discovered in libjpeg 9a. The gettextrgbrow function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.
Other sources
An issue was discovered in libjpeg version 9a. The gettextrgbrow function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.
References: https://github.com/ChijinZ/securityadvisories/tree/master/libjpeg-v9a
— Red Hat
An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2018-11214.
What is the severity of CVE-2018-11214?
The severity of CVE-2018-11214 is medium.
How does this vulnerability impact the system?
This vulnerability allows remote attackers to cause a denial of service by crashing the application.
Which software is affected by CVE-2018-11214?
The affected software includes libjpeg-turbo versions up to and including 1.2.90-8.el7, libjpeg-turbo versions 1.5.2-2+deb10u1, 2.0.6-4, and 2.1.5-2, libjpeg9 version 9e-1, libjpeg6b version 6 in Ubuntu Trusty, libjpeg6b versions 1:6 in Ubuntu Xenial, libjpeg-turbo versions 1:1.3.1-12+ and 1:1.4.2-1 in Ubuntu with upstream qualifiers, libjpeg-turbo version 1.3.0-0ubuntu2.1 in Ubuntu Trusty, and libjpeg9 version 1:9 in Ubuntu with upstream qualifiers.
How do I fix CVE-2018-11214?
To fix CVE-2018-11214, update to the latest version of the affected software.