CVE-2018-11212 An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
MediumCVSS 6.5
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libjpeg-turbo(Debian:12) | < 1:1.4.2-1 | 1:1.4.2-1 |
| debian/libjpeg-turbo(Debian:13) | < 1:1.4.2-1 | 1:1.4.2-1 |
| debian/libjpeg-turbo(Debian:14) | < 1:1.4.2-1 | 1:1.4.2-1 |
| alpine/openjdk7(Alpine:v3.10) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.11) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.12) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.13) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.14) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.15) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.16) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.17) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.18) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.6) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.7) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.8) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk7(Alpine:v3.9) | < 7.211.2.6.17-r0 | 7.211.2.6.17-r0 |
| alpine/openjdk8(Alpine:v3.10) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.11) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.12) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.13) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.14) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.15) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.16) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.17) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.18) | < 8.201.08-r0 | 8.201.08-r0 |
Show 37 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/openjdk8(Alpine:v3.19) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.20) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.21) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.22) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.23) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.24) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.6) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.7) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.8) | < 8.201.08-r0 | 8.201.08-r0 |
| alpine/openjdk8(Alpine:v3.9) | < 8.201.08-r0 | 8.201.08-r0 |
| ubuntu/libjpeg6b(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libjpeg6b(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libjpeg6b(Ubuntu:26.10) | All versions | No fix listed |
| ijg libjpeg | = 9a | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| netapp oncommand unified manager | All versions | No fix listed |
| netapp oncommand unified manager | >= 7.3 | No fix listed |
| netapp oncommand unified manager | >= 9.4 | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp snapmanager | All versions | No fix listed |
| oracle jdk | = 1.7.0-update201 | No fix listed |
| oracle jdk | = 1.8.0-update192 | No fix listed |
| oracle jdk | = 11.0.1 | No fix listed |
| oracle jre | = 8.0-update_191 | No fix listed |
| redhat satellite | = 5.8 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
| ubuntu/libjpeg6b(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3706-1 vendor-advisory
- USN-3706-2 vendor-advisory
- USN-5497-1 vendor-advisory
- USN-5497-2 vendor-advisory
- USN-5336-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-11212 vendor-advisory
- security.alpinelinux.org vendor-advisory
- 106583 third-party-advisory vdb-entry
- USN-3706-2 third-party-advisory vendor-advisory
- RHSA-2019:0474 third-party-advisory vendor-advisory
- USN-3706-1 third-party-advisory vendor-advisory
- [debian-lts-announce] 20190122 [SECURITY] [DLA 1638-1] libjpeg-turbo security update mailing-list third-party-advisory
- RHSA-2019:0469 third-party-advisory vendor-advisory
- RHSA-2019:0473 third-party-advisory vendor-advisory
- RHSA-2019:0472 third-party-advisory vendor-advisory
- openSUSE-SU-2019:0346 mailing-list third-party-advisory vendor-advisory
- RHSA-2019:0640 third-party-advisory vendor-advisory
- RHSA-2019:1238 vendor-advisory
- openSUSE-SU-2019:1439 vendor-advisory
- openSUSE-SU-2019:1500 vendor-advisory
- RHSA-2019:2052 vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com
- security.netapp.com patch third-party-advisory
- github.com exploit third-party-advisory
- www.ijg.org
- support.hpe.com
- github.com