CVE-2017-9614

High

Published: 27/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Risk Assessment

Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to service downtime and loss of system availability.

Recommendation

It is recommended to update libjpeg-turbo to the latest version to mitigate this vulnerability and to monitor applications for unauthorized access.

Other vulnerabilities in libjpeg-turbo 1.5.1

CVE-2026-75466Medium
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.

Original NVD description (English source)

The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API