CVE-2018-11212

high-risk

Published 2018-05-16

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

Do I need to act?

1.9% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Libjpeg

Debian Linux

Ubuntu Linux

Oncommand Unified Manager

Oncommand Workflow Automation

Snapmanager

Jdk

Jre

Satellite

Enterprise Linux Desktop

Enterprise Linux Server

Affected Vendors

Debian Redhat Oracle Canonical Netapp Opensuse Ijg

References (42)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html

http://www.ijg.org/

Third Party Advisory http://www.securityfocus.com/bid/106583

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0469

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0472

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0473

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0474

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0640

https://access.redhat.com/errata/RHSA-2019:1238

https://access.redhat.com/errata/RHSA-2019:2052

Exploit https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a

https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git

Third Party Advisory https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html

Patch https://security.netapp.com/advisory/ntap-20190118-0001/

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpe...

Third Party Advisory https://usn.ubuntu.com/3706-1/

Third Party Advisory https://usn.ubuntu.com/3706-2/

https://www.oracle.com/security-alerts/cpuapr2022.html

and 22 more references

/ 100

high-risk

Severity 24/34 · High

Exploitability 5/34 · Minimal

Exposure 21/34 · High