运行版本 CORE 5.04 / MAIN 5.04 的远程 NewStart CGSL 主机安装有受多个漏洞影响的 libjpeg-turbo 程序包：- libjpeg 在 cjpeg 实用工具中允许远程攻击者通过构造的文件造成拒绝服务（空指针取消引用和应用程序崩溃）或执行任意代码。(CVE-2016-3616) - libjpeg 9c 拥有大循环，因为 rdtarga.c 的 read_pixel 不当处理 EOF。(CVE-2018-11813) - 在 libjpeg 9a 中发现了一个问题。在 rdppm.c 中的 get_text_gray_row 函数允许远程攻击者通过构造的文件造成拒绝服务（分段错误）。(CVE-2018-11213) - 在 libjpeg 9a 中发现了一个问题。在 rdppm.c 中的 get_text_rgb_row 函数允许远程攻击者通过构造的文件造成拒绝服务（分段错误）。(CVE-2018-11214) - 在 libjpeg 9a 中发现了一个问题。在 jmemmgr.c 中的 alloc_sarray 函数允许远程攻击者通过构造的文件造成拒绝服务（除零错误）。(CVE-2018-11212) - libjpeg-turbo 1.5.90 之前的版本和 MozJPEG 3.3.1 之前的版本中的 rdbmp.c 的 get_8bit_row 允许攻击者通过构造的 8 位 BMP 造成拒绝服务（基于堆的缓冲区过度读取和应用程序崩溃），其中一个或多个颜色索引超过调色板条目的数量范围。(CVE-2018-14498) 请注意，Nessus 并未针对此问题进行测试，而仅依赖应用程序自我报告的版本号。

Debian 的默认 JPEG 实现 libjpeg-turbo 中解决了多个漏洞。CVE-2016-3616 libjpeg 中的 cjpeg 实用工具可让远程攻击者通过特制文件造成拒绝服务（空指针取消引用和应用崩溃）或执行任意代码。此问题可通过修复 CVE-2018-11213 和 CVE-2018-11214 的同一个补丁来修复。CVE-2018-1152 libjpeg-turbo 中发现，在处理特制的 BMP 图像时，容易受到除零造成的拒绝服务漏洞。此问题已通过边界检查解决。CVE-2018-11212 jmemmgr.c 中的 alloc_sarray 函数使远程攻击者可以通过特制的文件造成拒绝服务（除零错误）。此问题已通过在读取 targa 文件时检查图像大小解决，并且当图像宽度或高度为 0 时抛出错误来解决。CVE-2018-11213 CVE-2018-11214 rdppm.c 中的 get_text_gray_row 和 get_text_rgb_row 函数使远程攻击者可以通过特制的文件造成拒绝服务（段错误）。两个问题已通过检查 PPM 文本文件中的整数值范围，并添加检查确保数值在指定的范围内来解决 对于 Debian 8“Jessie”，这些问题已在 1:1.3.1-12+deb8u1 版本中修复。建议您升级 libjpeg-turbo 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

远程 Oracle Linux 7 主机上安装的多个程序包受到 ELSA-2019-2052 公告中提及的多个漏洞影响。

  - libjpeg 中的 cjpeg 实用工具让远程攻击者可通过特制的文件造成拒绝服务（空指针取消引用和应用崩溃）或执行任意代码。(CVE-2016-3616)

  - 在 libjpeg 9a 中发现一个问题。rdppm.c 中的 get_text_rgb_row 函数允许远程攻击者通过构造的文件造成拒绝服务（分段错误）。(CVE-2018-11214)

  - 在 libjpeg 9a 和 9d 中发现了一个问题。jmemmgr.c 中的 alloc_sarray 函数允许远程攻击者通过构建的文件造成拒绝服务（除以零错误）。(CVE-2018-11212)

  - 在 libjpeg 9a 中发现一个问题。rdppm.c 中的 get_text_gray_row 函数允许远程攻击者通过构造的文件造成拒绝服务（分段错误）。(CVE-2018-11213)

  - 因为 rdtarga.c 中的 read_pixel 不当处理 EOF，导致 libjpeg 9c 产生大型循环。(CVE-2018-11813) 

  - 在 libjpeg-turbo 1.5.90 及之前版本和 MozJPEG 3.3.1 及之前版本中，rdbmp.c 的 get_8bit_row 允许攻击者通过构造的 8 位 BMP（其中一个或多个颜色索引超过调色板条目的数量范围）造成拒绝服务（基于堆的缓冲区过度读取和应用程序崩溃）。(CVE-2018-14498)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 AOS 版本低于 5.11.2。因此，其受到 NXSA-AOS-5.11.2 公告中提及的多个漏洞影响。

  - Gnome Pango 1.42 及更高版本受到下列因素影响：缓冲区溢出。影响为：基于堆的缓冲区溢出可用来执行代码。组件为：函数名称：pango_log2vis_get_embedding_levels，nchars 和无限循环的任务。攻击向量为：当应用程序向 pango_itemize 等函数传递无效 utf-8 字符串时，可使用该错误。(CVE-2019-1010238)

  - curl 7.61.1 之前版本容易受到 NTLM 验证码中的缓冲区溢出漏洞影响。内部函数 Curl_ntlm_core_mk_nt_hash 会将密码长度乘以二 (SUM) 以计算从堆配置的临时存储区域大小。长度值之后会用来逐一循环访问密码，并在分配的存储缓冲区中生成输出。在具有 32 位 size_t 的系统上，当密码长度超过 2GB (2^31 个字节) 时，计算 SUM 的数学会触发整数溢出。此整数溢出通常会造成实际分配非常小的缓冲区，而不是预期非常大的缓冲区，进而利用该缓冲区结束堆缓冲区溢出。（此错误与 CVE-2017-8816 基本相同。）(CVE-2018-14618)

  - 在 libX11 1.6.5 及之前所有版本中，在 ListExt.c 的 XListExtensions 中发现一个问题。恶意服务器可发送首个字符串溢出的回复，造成变量设置为空，随后又将其释放，从而导致段错误和拒绝服务。(CVE-2018-14598)

  - 在 libX11 1.6.5 及之前所有版本中发现一个问题。ListExt.c 中的 XListExtensions 函数容易受到由恶意服务器响应导致的大小差一错误影响，从而导致 DoS 或可能造成其他不明影响。(CVE-2018-14599)

  - 在 libX11 1.6.5 及之前所有版本中发现一个问题。ListExt.c 中的 XListExtensions 函数会将变量解释为已签名，而非未签名，这可造成越界写入（最多 128 个字节），从而导致拒绝服务或远程代码执行。(CVE-2018-14600)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - libjpeg 中的 cjpeg 实用工具让远程攻击者可通过特制的文件造成拒绝服务（空指针取消引用和应用程序崩溃）或执行任意代码。(CVE-2016-3616)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.(CVE-2016-3616)

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)

An out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11214)

An out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.(CVE-2018-11213)

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.(CVE-2018-14498)

A divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.(CVE-2018-11212)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file.(CVE-2016-3616)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries.(CVE-2018-14498)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the libjpeg package has been released.

The version of AOS installed on the remote host is prior to 5.16. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
129912	NewStart CGSL CORE 5.04 / MAIN 5.04：libjpeg-turbo 多个漏洞 (NS-SA-2019-0185)	Nessus	NewStart CGSL Local Security Checks	10/15/2019	4/18/2024	high
121315	Debian DLA-1638-1：libjpeg-turbo 安全更新	Nessus	Debian Local Security Checks	1/23/2019	6/26/2024	high
180767	Oracle Linux 7：libjpeg-turbo (ELSA-2019-2052)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	high
164608	Nutanix AOS：多个漏洞 (NXSA-AOS-5.11.2)	Nessus	Misc.	9/1/2022	7/22/2025	critical
219667	Linux Distros 未修补的漏洞: CVE-2016-3616	Nessus	Misc.	3/4/2025	9/3/2025	high
129013	Amazon Linux AMI : libjpeg-turbo (ALAS-2019-1286)	Nessus	Amazon Linux Local Security Checks	9/19/2019	4/24/2024	high
132505	NewStart CGSL CORE 5.05 / MAIN 5.05 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0227)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	4/2/2024	high
131899	EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2019-2407)	Nessus	Huawei Local Security Checks	12/10/2019	4/4/2024	high
202903	Photon OS 1.0: Libjpeg PHSA-2020-1.0-0327	Nessus	PhotonOS Local Security Checks	7/22/2024	7/22/2024	high
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	9/1/2022	7/22/2025	critical

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

high

high

high

critical