In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5497-2 advisory.

  - An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote     attackers to cause a denial of service (divide-by-zero error) via a crafted file. (CVE-2018-11212)

  - An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers     to cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to     cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11214)

  - libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. (CVE-2018-11813)

  - In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the     max_memory_to_use setting, possibly causing excessive memory consumption. (CVE-2020-14152)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5336-1 advisory.

  - The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer     dereference and application crash) or execute arbitrary code via a crafted file. (CVE-2016-3616)

  - An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote     attackers to cause a denial of service (divide-by-zero error) via a crafted file. (CVE-2018-11212)

  - An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers     to cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to     cause a denial of service (Segmentation fault) via a crafted file. (CVE-2018-11214)

  - libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. (CVE-2018-11813)

  - In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the     max_memory_to_use setting, possibly causing excessive memory consumption. (CVE-2020-14152)

  - In IJG JPEG (aka libjpeg) from version 8 through 9c, jdhuff.c has an out-of-bounds array read for certain     table pointers. (CVE-2020-14153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5553-1 advisory.

  - libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF. (CVE-2018-11813)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to     cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in     which one or more of the color indices is out of range for the number of palette entries. (CVE-2018-14498)

  - In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the     max_memory_to_use setting, possibly causing excessive memory consumption. (CVE-2020-14152)

  - Libjpeg-turbo all version have a stack-based buffer overflow in the transform component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libjpeg-turbo all version have a stack-based buffer     overflow in the 'transform' component. A remote     attacker can send a malformed jpeg file to the service     and cause arbitrary code execution or denial of service     of the target service.(CVE-2020-17541)

  - In IJG JPEG (aka libjpeg) before 9d,     jpeg_mem_available() in jmemnobs.c in djpeg does not     honor the max_memory_to_use setting, possibly causing     excessive memory consumption.(CVE-2020-14152)

  - In generate_jsimd_ycc_rgb_convert_neon of     jsimd_arm64_neon.S, there is a possible out of bounds     write due to a missing bounds check. This could lead to     remote code execution in an unprivileged process with     no additional execution privileges needed. User     interaction is needed for exploitation.Product:
    AndroidVersions: Android-8.0 Android-8.1 Android-9     Android-10Android ID: A-120551338(CVE-2019-2201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In IJG JPEG (aka libjpeg) before 9d,     jpeg_mem_available() in jmemnobs.c in djpeg does not     honor the max_memory_to_use setting, possibly causing     excessive memory consumption.(CVE-2020-14152)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In IJG JPEG (aka libjpeg) before 9d,     jpeg_mem_available() in jmemnobs.c in djpeg does not     honor the max_memory_to_use setting, possibly causing     excessive memory consumption.(CVE-2020-14152)

  - CodeIgniter through 4.0.0 allows remote attackers to     gain privileges via a modified Email ID to the 'Select     Role of the User' page. NOTE: A contributor to the     CodeIgniter framework argues that the issue should not     be attributed to CodeIgniter. Furthermore, the blog     post reference shows an unknown website built with the     CodeIgniter framework but that CodeIgniter is not     responsible for introducing this issue because the     framework has never provided a login screen, nor any     kind of login or user management facilities beyond a     Session library.(CVE-2020-13790)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a     heap-based buffer over-read in get_rgb_row() in rdppm.c     via a malformed PPM input file.(CVE-2020-13790)

  - In IJG JPEG (aka libjpeg) before 9d,     jpeg_mem_available() in jmemnobs.c in djpeg does not     honor the max_memory_to_use setting, possibly causing     excessive memory consumption.(CVE-2020-14152)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In IJG JPEG (aka libjpeg) before 9d,     jpeg_mem_available() in jmemnobs.c in djpeg does not     honor the max_memory_to_use setting, possibly causing     excessive memory consumption.(CVE-2020-14152)

  - CodeIgniter through 4.0.0 allows remote attackers to     gain privileges via a modified Email ID to the 'Select     Role of the User' page. NOTE: A contributor to the     CodeIgniter framework argues that the issue should not     be attributed to CodeIgniter. Furthermore, the blog     post reference shows an unknown website built with the     CodeIgniter framework but that CodeIgniter is not     responsible for introducing this issue because the     framework has never provided a login screen, nor any     kind of login or user management facilities beyond a     Session library.(CVE-2020-13790)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were fixed in libjpeg-turbo, a widely used library for handling JPEG files.

CVE-2018-1152

Denial of service vulnerability caused by a divide by zero when processing a crafted BMP image in TJBench.

CVE-2018-14498

Denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.

CVE-2020-13790

Heap-based buffer over-read via a malformed PPM input file.

CVE-2020-14152

jpeg_mem_available() did not honor the max_memory_to_use setting, possibly causing excessive memory consumption.

For Debian 9 stretch, these problems have been fixed in version 1:1.5.1-2+deb9u1.

We recommend that you upgrade your libjpeg-turbo packages.

For the detailed security status of libjpeg-turbo please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/libjpeg-turbo

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183718	Ubuntu 16.04 ESM : Libjpeg6b vulnerabilities (USN-5497-2)	Nessus	Ubuntu Local Security Checks	high
183713	Ubuntu 16.04 ESM : libjpeg9 vulnerabilities (USN-5336-1)	Nessus	Ubuntu Local Security Checks	high
163922	Ubuntu 16.04 ESM : libjpeg-turbo vulnerabilities (USN-5553-1)	Nessus	Ubuntu Local Security Checks	high
153340	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2021-2396)	Nessus	Huawei Local Security Checks	high
145129	EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2021-1085)	Nessus	Huawei Local Security Checks	high
142536	EulerOS Virtualization 3.0.6.6 : libjpeg-turbo (EulerOS-SA-2020-2457)	Nessus	Huawei Local Security Checks	high
140319	EulerOS Virtualization for ARM 64 3.0.2.0 : libjpeg-turbo (EulerOS-SA-2020-1949)	Nessus	Huawei Local Security Checks	high
140160	EulerOS 2.0 SP5 : libjpeg-turbo (EulerOS-SA-2020-1939)	Nessus	Huawei Local Security Checks	high
139245	Debian DLA-2302-1 : libjpeg-turbo security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-14152

high

Tenable Plugins

high

high

high

high

high

high

high

high

high