{"id":"CVE-2018-14498","aliases":["ALPINE-CVE-2018-14498","ALSA-2019:3705","BELL-CVE-2018-14498","DEBIAN-CVE-2018-14498","DLA-1719-1","DLA-2302-1","EUVD-2018-6414","GHSA-jg8v-w7gx-4g68","MGASA-2019-0132","RHSA-2019:2052","RHSA-2019:3705","RLSA-2019:3705","SUSE-SU-2019:0711-1","SUSE-SU-2019:1111-1","UBUNTU-CVE-2018-14498","USN-4190-1","USN-5553-1","openSUSE-SU-2019:1118-1"],"status":"published","title":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows...","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03092,"percentile":0.8781,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-03-07T22:00:00Z","modified":"2026-10-29T11:00:03Z","fixes":[{"ecosystem":"Alpine:v3.7","package":"libjpeg-turbo","fixed_in":["1.5.3-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libjpeg-turbo","fixed_in":["1.5.3-r5"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libjpeg-turbo","fixed_in":["1.5.3-r5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"turbojpeg-devel","fixed_in":["1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libjpeg-turbo","fixed_in":["1:2.0.5-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libjpeg-turbo","fixed_in":["1:1.3.1-12+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"libjpeg","fixed_in":["1.5.1-1.3.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debuginfo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debugsource","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-devel","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils-debuginfo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg-debuginfo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debuginfo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debugsource","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-utils-debuginfo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-debuginfo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-devel","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libjpeg-turbo","fixed_in":["0:1.5.3-10.el8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","fixed_in":["1.3.0-0ubuntu2.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libjpeg-turbo","fixed_in":["1.4.2-0ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","fixed_in":["1.5.2-0ubuntu5.18.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.7","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-r5"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-r5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.0.5-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.1-12+deb8u2"}]}],"versions":["1:1.3.1-12","1:1.3.1-12+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-2+deb9u1"}]}],"versions":["1:1.5.1-2"],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"libjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.3.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libjpeg-turbo-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libjpeg-turbo-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libjpeg-turbo-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libjpeg-turbo-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.90-8.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libjpeg-turbo-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"turbojpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libjpeg-turbo-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"turbojpeg-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-10.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-5.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-31.14.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-0ubuntu2.1+esm2"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1","1.3.0-0ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.3"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.3"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.3"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-0ubuntu5.18.04.3"}]}],"versions":["1.5.2-0ubuntu5","1.5.2-0ubuntu5.18.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-0ubuntu2.1+esm2"}]}],"versions":["1.3.0-0ubuntu1","1.3.0-0ubuntu2","1.3.0-0ubuntu2.1","1.3.0-0ubuntu2.1+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-0ubuntu3.4+esm1"}]}],"versions":["1.3.0-0ubuntu2","1.4.2-0ubuntu1","1.4.2-0ubuntu2","1.4.2-0ubuntu3","1.4.2-0ubuntu3.1","1.4.2-0ubuntu3.3","1.4.2-0ubuntu3.4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libjpeg-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp150.4.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"libjpeg62-turbo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-lp150.4.3.2"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libjpeg-turbo","product":"libjpeg-turbo"},{"vendor":"mozilla","product":"mozjpeg"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/issues/258","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/mozilla/mozjpeg/issues/299","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2052","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3705","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://usn.ubuntu.com/4190-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00033.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14498","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/"},{"url":"https://github.com/advisories/GHSA-jg8v-w7gx-4g68"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-14498","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2018-14498","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-14498","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14498","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0132.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24565","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2019-March/005227.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1318509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1319661","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1588803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1687424","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2052.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3616","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11212","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11212","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11213","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11213","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11214","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11214","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-11813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-11813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11813","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14498","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14498","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688397","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3705.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:3705","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190711-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1096209","tags":["report"]},{"url":"https://bugzilla.suse.com/1098155","tags":["report"]},{"url":"https://bugzilla.suse.com/1128712","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191111-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-14498","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4190-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5553-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-19664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20330","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-2201","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11813","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-14152","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-17541","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7PGXD27E76CECHHIGW57SLEC6FXMAF5N/#7PGXD27E76CECHHIGW57SLEC6FXMAF5N","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T22:00:00Z","modified":"2024-08-05T09:29:51.678Z","updated_at":"2026-11-02T14:35:00.589142Z"}],"euvd":[{"id":"EUVD-2018-6414","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T22:00:00Z","modified":"2024-08-05T09:29:51Z","updated_at":"2026-11-03T02:39:46.696329Z"}],"ghsa":[{"id":"GHSA-jg8v-w7gx-4g68","title":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows...","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2022-05-13T01:24:46Z","modified":"2023-02-01T05:07:33Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:33.423478Z"}],"nvd":[{"id":"CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T23:29:00.487Z","modified":"2026-06-17T01:41:06.78Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"ALPINE-CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T23:29:00.487Z","modified":"2026-10-23T17:23:45.778802042Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-14498","title":"CVE-2018-14498 does not affect BellSoft software","status":"withdrawn","published":"2019-03-07T23:29:00Z","modified":"2026-01-26T09:47:11.178185Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T23:29:00.487Z","modified":"2026-10-20T13:35:29.49022661Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T23:29:00.487Z","modified":"2026-10-23T18:02:59.323188857Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2019:2052","title":"Red Hat Security Advisory: libjpeg-turbo security update","status":"published","published":"2024-09-16T01:57:39Z","modified":"2026-10-16T10:01:18Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3705","title":"Red Hat Security Advisory: libjpeg-turbo security update","status":"published","published":"2024-09-16T01:57:46Z","modified":"2026-06-26T12:21:59.927897971Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RLSA-2019:3705","title":"Moderate: libjpeg-turbo security update","description":"The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.","status":"published","published":"2019-11-05T20:53:12Z","modified":"2026-02-05T03:45:13.441913Z","cvss":[{"version":"3.0","score":4.4,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2018-14498","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.","status":"published","published":"2019-03-07T23:29:00Z","modified":"2026-04-22T11:45:57.425546Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"ALSA-2019:3705","title":"Moderate: libjpeg-turbo security update","description":"The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2019-11-05T20:53:12Z","modified":"2026-10-29T11:00:03.832022784Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-1719-1","title":"libjpeg-turbo - security update","status":"published","published":"2019-03-18T00:00:00Z","modified":"2026-03-09T01:23:01.049083Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2302-1","title":"libjpeg-turbo - security update","status":"published","published":"2020-07-31T00:00:00Z","modified":"2026-03-09T01:19:08.322972Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0132","title":"Updated libjpeg packages fix security vulnerability","description":"get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through\n3.3.1 allows attackers to cause a denial of service (heap-based buffer\nover-read and application crash) via a crafted 8-bit BMP in which one or\nmore of the color indices is out of range for the number of palette\nentries. (CVE-2018-14498)\n","status":"published","published":"2019-04-05T18:12:59Z","modified":"2026-04-16T04:42:26.017455817Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1118-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\nThe following security vulnerabilities were addressed:\n\n- CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row function \n  which could allow to an attacker to cause denial of service (bsc#1128712).\n- CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in rdtarga.c,\n  which allowed remote attackers to cause a denial-of-service via crafted JPG\n  files due to a large loop (bsc#1096209)\n- CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c caused\n  by a divide by zero when processing a crafted BMP image (bsc#1098155)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-04-02T11:05:26Z","modified":"2026-02-04T02:44:13.971191Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"SUSE-SU-2019:0711-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\nThe following security vulnerabilities were addressed:\n\n- CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row function \n  which could allow to an attacker to cause denial of service (bsc#1128712).\n- CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in rdtarga.c,\n  which allowed remote attackers to cause a denial-of-service via crafted JPG\n  files due to a large loop (bsc#1096209)\n- CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c caused\n  by a divide by zero when processing a crafted BMP image (bsc#1098155)\n","status":"published","published":"2019-03-22T14:51:19Z","modified":"2026-02-04T02:54:53.843541Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:1111-1","title":"Security update for libjpeg-turbo","description":"This update for libjpeg-turbo fixes the following issues:\n\nThe following security vulnerabilities were addressed:\n\n- CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row function\n  which could allow to an attacker to cause denial of service (bsc#1128712).\n- CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in rdtarga.c,\n  which allowed remote attackers to cause a denial-of-service via crafted JPG\n  files due to a large loop (bsc#1096209)\n- CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c caused\n  by a divide by zero when processing a crafted BMP image (bsc#1098155)\n","status":"published","published":"2019-04-30T10:59:46Z","modified":"2026-02-04T03:27:51.820632Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4190-1","title":"libjpeg-turbo vulnerabilities","description":"It was discovered that libjpeg-turbo incorrectly handled certain BMP images.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.\n(CVE-2018-14498)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain JPEG images.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 19.04. (CVE-2018-19664)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain BMP images.\nAn attacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 19.04. (CVE-2018-20330)\n\nIt was discovered that libjpeg-turbo incorrectly handled certain JPEG images.\nAn attacker could possibly cause a denial of service or execute arbitrary code.\n(CVE-2019-2201)\n","status":"published","published":"2019-11-13T14:35:21Z","modified":"2026-04-22T10:02:28.121299Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-5553-1","title":"libjpeg-turbo vulnerabilities","description":"It was discovered that libjpeg-turbo was not properly handling EOF characters,\nwhich could lead to excessive memory consumption through the execution of a\nlarge loop. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2018-11813)\n\nIt was discovered that libjpeg-turbo was not properly performing bounds\ncheck operations, which could lead to a heap-based buffer overread. If a user\nor automated system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 14.04 ESM. (CVE-2018-14498)\n\nIt was discovered that libjpeg-turbo was not properly limiting the amount of\nmain memory being consumed by the system during decompression or multi-pass\ncompression operations, which could lead to excessive memory consumption. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2020-14152)\n\nIt was discovered that libjpeg-turbo was not properly setting variable sizes\nwhen performing certain kinds of encoding operations, which could lead to a\nstack-based buffer overflow. If a user or automated system were tricked into\nopening a specially crafted file, an attacker could possibly use this issue to\ncause a denial of service. (CVE-2020-17541)\n","status":"published","published":"2022-08-08T12:06:20Z","modified":"2026-06-29T13:49:40.215117423Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}