CVE-2018-11212

Description

An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

Scores

Faiblesses (CWE)

• CWE-369

Références européennes

• ENISA EUVD · EUVD-2018-3252
• GCVE · GCVE-0-2018-11212

Avis du CERT-FR

• CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
• CERTFR-2019-AVI-022 — Multiples vulnérabilités dans Oracle Java SE · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:ijg:libjpeg:9a:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
• cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* ≥ 7.3
• cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:* ≥ 9.4
• cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*
• cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*
• cpe:2.3:a:oracle:jdk:1.7.0:update201:*:*:*:*:*:*
• cpe:2.3:a:oracle:jdk:1.8.0:update192:*:*:*:*:*:*
• cpe:2.3:a:oracle:jdk:11.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:jre:8.0:update_191:*:*:*:*:*:*
• cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
• cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

Produits affectés

Références

• http://www.securityfocus.com/bid/106583
• https://usn.ubuntu.com/3706-2/
• https://access.redhat.com/errata/RHSA-2019:0474
• https://usn.ubuntu.com/3706-1/
• https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html
• https://access.redhat.com/errata/RHSA-2019:0469
• https://access.redhat.com/errata/RHSA-2019:0473
• https://access.redhat.com/errata/RHSA-2019:0472
• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html
• https://access.redhat.com/errata/RHSA-2019:0640
• https://access.redhat.com/errata/RHSA-2019:1238
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html
• https://access.redhat.com/errata/RHSA-2019:2052
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://security.netapp.com/advisory/ntap-20190118-0001/
• https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a
• http://www.ijg.org/
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us
• https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git

Sources