libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.

According to the version of the libjpeg-turbo package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The libjpeg-turbo package contains a library of     functions for manipulatingJPEG images.Security     Fix(es):libjpeg-turbo 1.5.2 has a NULL Pointer     Dereference in jdpostct.c and jquant1.c via a crafted     JPEG file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In generate_jsimd_ycc_rgb_convert_neon of     jsimd_arm64_neon.S, there is a possible out of bounds     write due to a missing bounds check. This could lead to     remote code execution in an unprivileged process with     no additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-8.0 Android-8.1 Android-9     Android-10Android ID: A-120551338(CVE-2019-2201)

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in     jdpostct.c and jquant1.c via a crafted JPEG     file.(CVE-2017-15232)

  - libjpeg-turbo before 1.3.1 allows remote attackers to     cause a denial of service (crash) via a crafted JPEG     file, related to the Exif marker.(CVE-2014-9092)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libjpeg package has been released.

It was discovered that libjpeg-turbo incorrectly handled certain malformed JPEG images. If a user or automated system were tricked into opening a specially crafted JPEG image, a remote attacker could cause libjpeg-turbo to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jpeg fixes the following issues :

  - CVE-2017-15232: NULL pointer dereferences in jdpostct.c     and jquant1.c could lead to denial of service (crash)     when processing images [bsc#1062937]

  - CVE-2018-11813: Fixed the end-of-file mishandling in     read_pixel in rdtarga.c, which allowed remote attackers     to cause a denial-of-service via crafted JPG files due     to a large loop [bsc#1096209]

  - CVE-2018-1152: Fixed a denial of service in     start_input_bmp() rdbmp.c caused by a divide by zero     when processing a crafted BMP image [bsc#1098155]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libjpeg-turbo fixes the following security issue :

  - CVE-2017-15232: Fix NULL pointer dereference in     jdpostct.c and jquant1.c - additional fixes     (bsc#1062937)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libjpeg-turbo fixes the following issues: Feature update :

  - Update from version 1.3.1 to version 1.5.2     (fate#324061). Security issue fixed :

  - CVE-2017-15232: Fix NULL pointer dereference in     jdpostct.c and jquant1.c (bsc#1062937).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libjpeg-turbo to version 1.5.2 fixes the following issues :

  - CVE-2017-15232: NULL pointer dereference in jdpostct.c     and jquant1.c (boo#1062937)

This compatible version update contains the following improvements :

  - Improved and updated upsampling support and sampling     factors

  - Memory handling correctness fixes

  - Improved robustness when decoding images

This version is a dependency of Chromium 62.

ID	Name	Product	Family	Severity
151894	EulerOS Virtualization 3.0.2.2 : libjpeg-turbo (EulerOS-SA-2021-2144)	Nessus	Huawei Local Security Checks	medium
151311	EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2021-2093)	Nessus	Huawei Local Security Checks	medium
147114	EulerOS Virtualization 3.0.6.6 : libjpeg-turbo (EulerOS-SA-2021-1489)	Nessus	Huawei Local Security Checks	high
146708	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2021-1316)	Nessus	Huawei Local Security Checks	medium
146153	EulerOS 2.0 SP5 : libjpeg-turbo (EulerOS-SA-2021-1202)	Nessus	Huawei Local Security Checks	medium
135531	EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2020-1402)	Nessus	Huawei Local Security Checks	medium
121789	Photon OS 2.0: Libjpeg PHSA-2017-2.0-0007	Nessus	PhotonOS Local Security Checks	medium
110973	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : libjpeg-turbo vulnerabilities (USN-3706-1)	Nessus	Ubuntu Local Security Checks	high
110762	SUSE SLES11 Security Update : jpeg (SUSE-SU-2018:1825-1)	Nessus	SuSE Local Security Checks	high
106665	openSUSE Security Update : libjpeg-turbo (openSUSE-2018-141)	Nessus	SuSE Local Security Checks	medium
106653	SUSE SLED12 / SLES12 Security Update : libjpeg-turbo (SUSE-SU-2018:0373-1)	Nessus	SuSE Local Security Checks	medium
104243	openSUSE Security Update : libjpeg-turbo (openSUSE-2017-1218)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2017-15232

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

high

high

medium

medium

medium