PT-2017-19073 · Libjpeg Turbo+1 · Libjpeg-Turbo+1

Qflb.Wu · Published 2017-07-27 · Updated 2024-08-05 · CVE-2017-9614

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libjpeg-turbo version 1.5.1

Description The issue allows remote attackers to cause a denial of service, resulting in invalid memory access and application crash, or possibly have other unspecified impacts via a crafted jpg file. It is noted that the maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API.

Recommendations For libjpeg-turbo version 1.5.1, consider avoiding the use of the fill input buffer function in jdatasrc.c until a patch is available, or ensure proper use of the libjpeg API to prevent misuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2019-1611

CVE-2017-9614

Affected Products

Alt Linux

Libjpeg-Turbo

References · 10

• 🔥 https://github.com/libjpeg-turbo/libjpeg-turbo/issues/167 · Exploit
• 🔥 https://exploit-db.com/exploits/42391 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-9614 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1611 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9614 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9614 · Security Note
• http://packetstormsecurity.com/files/143518/libjpeg-turbo-1.5.1-Denial-Of-Service.html · Note
• https://t.me/cvenotify/89252 · Telegram Post
• http://seclists.org/fulldisclosure/2017/Jul/66 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2017-9614 · Note