CVE-2018-14498
Fixed in a distro release EPSS 3%
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
Products: libjpeg-turbo, mozilla mozjpeg, fedoraproject fedora, debian_linux, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | turbojpeg-devel | 1.5.3-10.el8 |
| Alpine 3.7 | libjpeg-turbo | 1.5.3-r3 |
| Alpine 3.8 | libjpeg-turbo | 1.5.3-r5 |
| Alpine 3.9 | libjpeg-turbo | 1.5.3-r5 |
| Amazon Linux 2 | libjpeg-turbo | 1.2.90-6.amzn2.0.3 |
| Amazon Linux 2 | libjpeg-turbo-devel | 1.2.90-6.amzn2.0.3 |
| Amazon Linux 2 | libjpeg-turbo-static | 1.2.90-6.amzn2.0.3 |
| Amazon Linux 2 | libjpeg-turbo-utils | 1.2.90-6.amzn2.0.3 |
| Amazon Linux 2 | turbojpeg | 1.2.90-6.amzn2.0.3 |
| Amazon Linux 2 | turbojpeg-devel | 1.2.90-6.amzn2.0.3 |
| Debian 12 | libjpeg-turbo | 1:2.0.5-1 |
| Debian 13 | libjpeg-turbo | 1:2.0.5-1 |
| Debian 14 | libjpeg-turbo | 1:2.0.5-1 |
| Debian 8 | libjpeg-turbo | 1:1.3.1-12+deb8u2 |
| Debian 9 | libjpeg-turbo | 1:1.5.1-2+deb9u1 |
| Red Hat Enterprise Linux 7 | libjpeg-turbo | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 7 | libjpeg-turbo-debuginfo | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 7 | libjpeg-turbo-devel | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 7 | libjpeg-turbo-static | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 7 | libjpeg-turbo-utils | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 7 | turbojpeg | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 7 | turbojpeg-devel | 0:1.2.90-8.el7 |
| Red Hat Enterprise Linux 8 | libjpeg-turbo | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | libjpeg-turbo-debuginfo | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | libjpeg-turbo-debugsource | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | libjpeg-turbo-devel | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | libjpeg-turbo-utils | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | libjpeg-turbo-utils-debuginfo | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | turbojpeg | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | turbojpeg-debuginfo | 0:1.5.3-10.el8 |
| Red Hat Enterprise Linux 8 | turbojpeg-devel | 0:1.5.3-10.el8 |
| Rocky Linux 8 | libjpeg-turbo | 0:1.5.3-10.el8 |
| SUSE Linux Enterprise Desktop 12 SP3 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Desktop 12 SP3 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Desktop 12 SP4 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Desktop 12 SP4 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Module for Basesystem 15 | libjpeg-turbo | 1.5.3-5.7.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | libjpeg62-turbo | 1.5.3-5.7.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 | libjpeg-turbo | 1.5.3-5.7.1 |
| SUSE Linux Enterprise Module for Package Hub 15 | libjpeg-turbo | 1.5.3-5.7.1 |
| SUSE Linux Enterprise Server 12 SP3 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server 12 SP3 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server 12 SP4 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server 12 SP4 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libjpeg62-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | libjpeg-turbo | 1.5.3-31.14.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | libjpeg62-turbo | 1.5.3-31.14.2 |
| Ubuntu 16.04 LTS | libjpeg-turbo | 1.4.2-0ubuntu3.3 |
| Ubuntu 18.04 LTS | libjpeg-turbo | 1.5.2-0ubuntu5.18.04.3 |
| Ubuntu Pro 14.04 LTS | libjpeg-turbo | 1.3.0-0ubuntu2.1+esm2 |
| Ubuntu Pro 16.04 LTS | libjpeg-turbo | 1.4.2-0ubuntu3.4+esm1 |
| openSUSE Leap 15.0 | libjpeg-turbo | 1.5.3-lp150.4.3.2 |
| openSUSE Leap 15.0 | libjpeg62-turbo | 1.5.3-lp150.4.3.2 |