CVE-2018-11212
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
Risk Assessment
Processing a malicious image file can crash an application using libjpeg, leading to service unavailability.
Recommendation
Update libjpeg to a version containing the fix or apply a workaround by validating processed image files.
Other vulnerabilities in libjpeg
See all- CVE-2016-3616High
The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.
- CVE-2016-6702High
A remote code execution vulnerability in libjpeg in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process.
- CVE-2023-37837Medium
A heap buffer overflow was discovered in the libjpeg library in the LineBitmapRequester::EncodeRegion function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
- CVE-2023-37836Medium
A vulnerability in the libjpeg library was discovered that allows for a reachable assertion in the BitMapHook::BitMapHook method in bitmaphook.cpp. This vulnerability can be exploited by attackers to cause a Denial of Service (DoS) via a crafted file.
Original NVD description (English source)
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS