CVE-2018-11214 - An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attack

CVE-2018-11214

Summary

An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

References

Vulnerable Configurations

cpe:2.3:a:ijg:libjpeg:9a:*:*:*:*:*:*:*
cpe:2.3:a:ijg:libjpeg:9a:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

CVSS

Base:	4.3 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

redhat via4

advisories

rhsa

id	RHSA-2019:2052

rpms

libjpeg-turbo-0:1.2.90-8.el7
libjpeg-turbo-debuginfo-0:1.2.90-8.el7
libjpeg-turbo-devel-0:1.2.90-8.el7
libjpeg-turbo-static-0:1.2.90-8.el7
libjpeg-turbo-utils-0:1.2.90-8.el7
turbojpeg-0:1.2.90-8.el7
turbojpeg-devel-0:1.2.90-8.el7

refmap via4

misc	https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a
mlist	[debian-lts-announce] 20190122 [SECURITY] [DLA 1638-1] libjpeg-turbo security update
ubuntu	USN-3706-1 USN-3706-2

Last major update

03-10-2019 - 00:03

Published

16-05-2018 - 17:29

Last modified

03-10-2019 - 00:03