{"cve": [{"lastseen": "2021-02-02T06:52:25", "description": "libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.", "edition": 7, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 3.6}, "published": "2018-06-06T03:29:00", "title": "CVE-2018-11813", "type": "cve", "cwe": ["CWE-834"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-11813"], "modified": "2020-06-25T14:15:00", "cpe": ["cpe:/a:ijg:libjpeg:9c"], "id": "CVE-2018-11813", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11813", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:ijg:libjpeg:9c:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2020-01-27T18:38:53", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220181298", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220181298", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2018-1298)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2018.1298\");\n script_version(\"2020-01-23T11:20:35+0000\");\n script_cve_id(\"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:20:35 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:20:35 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2018-1298)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2018-1298\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1298\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libjpeg-turbo' package(s) announced via the EulerOS-SA-2018-1298 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.2.90~5.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo-devel\", rpm:\"libjpeg-turbo-devel~1.2.90~5.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:56", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-06-27T00:00:00", "id": "OPENVAS:1361412562310874744", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874744", "type": "openvas", "title": "Fedora Update for libjpeg-turbo FEDORA-2018-0e72ef852a", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_0e72ef852a_libjpeg-turbo_fc28.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for libjpeg-turbo FEDORA-2018-0e72ef852a\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874744\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-06-27 06:03:19 +0200 (Wed, 27 Jun 2018)\");\n script_cve_id(\"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libjpeg-turbo FEDORA-2018-0e72ef852a\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libjpeg-turbo'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\non the target host.\");\n script_tag(name:\"affected\", value:\"libjpeg-turbo on Fedora 28\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-0e72ef852a\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CDV3ULRXQEMV7OHCB5MSITEIVOI5EPN\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.5.3~5.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-27T18:37:57", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220181299", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220181299", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2018-1299)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2018.1299\");\n script_version(\"2020-01-23T11:20:36+0000\");\n script_cve_id(\"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:20:36 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:20:36 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2018-1299)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2018-1299\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1299\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libjpeg-turbo' package(s) announced via the EulerOS-SA-2018-1299 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on Huawei EulerOS V2.0SP3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.2.90~5.h1\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo-devel\", rpm:\"libjpeg-turbo-devel~1.2.90~5.h1\", rls:\"EULEROS-2.0SP3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-27T18:36:28", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191079", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191079", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2019-1079)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1079\");\n script_version(\"2020-01-23T11:30:37+0000\");\n script_cve_id(\"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:30:37 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:30:37 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2019-1079)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1079\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1079\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libjpeg-turbo' package(s) announced via the EulerOS-SA-2019-1079 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.(CVE-2018-11813)\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on Huawei EulerOS Virtualization 2.5.2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.2.90~5.h1\", rls:\"EULEROSVIRT-2.5.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-27T18:36:11", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220191159", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220191159", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2019-1159)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2019.1159\");\n script_version(\"2020-01-23T11:33:19+0000\");\n script_cve_id(\"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:33:19 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:33:19 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for libjpeg-turbo (EulerOS-SA-2019-1159)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROSVIRT-2\\.5\\.3\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2019-1159\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1159\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'libjpeg-turbo' package(s) announced via the EulerOS-SA-2019-1159 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.CVE-2018-11813\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on Huawei EulerOS Virtualization 2.5.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROSVIRT-2.5.3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.2.90~5.h1\", rls:\"EULEROSVIRT-2.5.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:57", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2018-07-12T00:00:00", "id": "OPENVAS:1361412562310874788", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310874788", "type": "openvas", "title": "Fedora Update for libjpeg-turbo FEDORA-2018-930dd33e43", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2018_930dd33e43_libjpeg-turbo_fc28.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for libjpeg-turbo FEDORA-2018-930dd33e43\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.874788\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-07-12 06:10:28 +0200 (Thu, 12 Jul 2018)\");\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for libjpeg-turbo FEDORA-2018-930dd33e43\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libjpeg-turbo'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on\nthe target host.\");\n script_tag(name:\"affected\", value:\"libjpeg-turbo on Fedora 28\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"FEDORA\", value:\"2018-930dd33e43\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHRJSPZHPTSJWFXG5YW7OD4MM4WAPXFF\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC28\")\n{\n\n if ((res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.5.3~6.fc28\", rls:\"FC28\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-31T16:47:28", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2019-04-03T00:00:00", "id": "OPENVAS:1361412562310852362", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852362", "type": "openvas", "title": "openSUSE: Security Advisory for libjpeg-turbo (openSUSE-SU-2019:1118-1)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852362\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\", \"CVE-2018-14498\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-04-03 06:41:32 +0000 (Wed, 03 Apr 2019)\");\n script_name(\"openSUSE: Security Advisory for libjpeg-turbo (openSUSE-SU-2019:1118-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:1118-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libjpeg-turbo'\n package(s) announced via the openSUSE-SU-2019:1118-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for libjpeg-turbo fixes the following issues:\n\n The following security vulnerabilities were addressed:\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\n function which could allow to an attacker to cause denial of service\n (bsc#1128712).\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\n rdtarga.c, which allowed remote attackers to cause a denial-of-service\n via crafted JPG files due to a large loop (bsc#1096209)\n\n - CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\n caused by a divide by zero when processing a crafted BMP image\n (bsc#1098155)\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2019-1118=1\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.5.3~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo-debuginfo\", rpm:\"libjpeg-turbo-debuginfo~1.5.3~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo-debugsource\", rpm:\"libjpeg-turbo-debugsource~1.5.3~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62\", rpm:\"libjpeg62~62.2.0~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-debuginfo\", rpm:\"libjpeg62-debuginfo~62.2.0~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-devel\", rpm:\"libjpeg62-devel~62.2.0~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-turbo\", rpm:\"libjpeg62-turbo~1.5.3~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-turbo-debugsource\", rpm:\"libjpeg62-turbo-debugsource~1.5.3~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8\", rpm:\"libjpeg8~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-debuginfo\", rpm:\"libjpeg8-debuginfo~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-devel\", rpm:\"libjpeg8-devel~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0\", rpm:\"libturbojpeg0~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0-debuginfo\", rpm:\"libturbojpeg0-debuginfo~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-32bit\", rpm:\"libjpeg62-32bit~62.2.0~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-32bit-debuginfo\", rpm:\"libjpeg62-32bit-debuginfo~62.2.0~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-devel-32bit\", rpm:\"libjpeg62-devel-32bit~62.2.0~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-32bit\", rpm:\"libjpeg8-32bit~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-32bit-debuginfo\", rpm:\"libjpeg8-32bit-debuginfo~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-devel-32bit\", rpm:\"libjpeg8-devel-32bit~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0-32bit\", rpm:\"libturbojpeg0-32bit~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0-32bit-debuginfo\", rpm:\"libturbojpeg0-32bit-debuginfo~8.1.2~lp150.4.3.2\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-31T16:48:01", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2019-05-09T00:00:00", "id": "OPENVAS:1361412562310852476", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852476", "type": "openvas", "title": "openSUSE: Security Advisory for libjpeg-turbo (openSUSE-SU-2019:1343-1)", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852476\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\", \"CVE-2018-14498\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-05-09 02:00:41 +0000 (Thu, 09 May 2019)\");\n script_name(\"openSUSE: Security Advisory for libjpeg-turbo (openSUSE-SU-2019:1343-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:1343-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libjpeg-turbo'\n package(s) announced via the openSUSE-SU-2019:1343-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for libjpeg-turbo fixes the following issues:\n\n The following security vulnerabilities were addressed:\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\n function which could allow to an attacker to cause denial of service\n (bsc#1128712).\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\n rdtarga.c, which allowed remote attackers to cause a denial-of-service\n via crafted JPG files due to a large loop (bsc#1096209)\n\n - CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\n caused by a divide by zero when processing a crafted BMP image\n (bsc#1098155)\n\n This update was imported from the SUSE:SLE-12:Update update project.\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 42.3:\n\n zypper in -t patch openSUSE-2019-1343=1\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on openSUSE Leap 42.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.3\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.5.3~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo-debuginfo\", rpm:\"libjpeg-turbo-debuginfo~1.5.3~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo-debugsource\", rpm:\"libjpeg-turbo-debugsource~1.5.3~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62\", rpm:\"libjpeg62~62.2.0~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-debuginfo\", rpm:\"libjpeg62-debuginfo~62.2.0~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-devel\", rpm:\"libjpeg62-devel~62.2.0~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-turbo\", rpm:\"libjpeg62-turbo~1.5.3~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-turbo-debugsource\", rpm:\"libjpeg62-turbo-debugsource~1.5.3~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8\", rpm:\"libjpeg8~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-debuginfo\", rpm:\"libjpeg8-debuginfo~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-devel\", rpm:\"libjpeg8-devel~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0\", rpm:\"libturbojpeg0~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0-debuginfo\", rpm:\"libturbojpeg0-debuginfo~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-32bit\", rpm:\"libjpeg62-32bit~62.2.0~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-debuginfo-32bit\", rpm:\"libjpeg62-debuginfo-32bit~62.2.0~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg62-devel-32bit\", rpm:\"libjpeg62-devel-32bit~62.2.0~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-32bit\", rpm:\"libjpeg8-32bit~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-debuginfo-32bit\", rpm:\"libjpeg8-debuginfo-32bit~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg8-devel-32bit\", rpm:\"libjpeg8-devel-32bit~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0-32bit\", rpm:\"libturbojpeg0-32bit~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libturbojpeg0-debuginfo-32bit\", rpm:\"libturbojpeg0-debuginfo-32bit~8.1.2~45.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:13", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "description": "The remote host is missing an update for the ", "modified": "2019-04-03T00:00:00", "published": "2019-04-03T00:00:00", "id": "OPENVAS:1361412562310875535", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310875535", "type": "openvas", "title": "Fedora Update for libjpeg-turbo FEDORA-2019-87e2fa8e0f", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.875535\");\n script_version(\"2019-04-03T06:52:01+0000\");\n script_cve_id(\"CVE-2018-14498\", \"CVE-2018-1152\", \"CVE-2018-11813\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-04-03 06:52:01 +0000 (Wed, 03 Apr 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-04-03 06:52:01 +0000 (Wed, 03 Apr 2019)\");\n script_name(\"Fedora Update for libjpeg-turbo FEDORA-2019-87e2fa8e0f\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC28\");\n\n script_xref(name:\"FEDORA\", value:\"2019-87e2fa8e0f\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7YP4QUEYGHI4Q7GIAVFVKWQ7DJMBYLU\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'libjpeg-turbo'\n package(s) announced via the FEDORA-2019-87e2fa8e0f advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The libjpeg-turbo package contains a library of functions for manipulating JPEG\nimages.\");\n\n script_tag(name:\"affected\", value:\"'libjpeg-turbo' package(s) on Fedora 28.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC28\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjpeg-turbo\", rpm:\"libjpeg-turbo~1.5.3~7.fc28\", rls:\"FC28\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "nessus": [{"lastseen": "2021-01-07T08:55:00", "description": "According to the version of the libjpeg-turbo package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.i1/4^CVE-2018-11813i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 10, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-04-09T00:00:00", "title": "EulerOS Virtualization 2.5.3 : libjpeg-turbo (EulerOS-SA-2019-1159)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "modified": "2019-04-09T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:libjpeg-turbo", "cpe:/o:huawei:euleros:uvp:2.5.3"], "id": "EULEROS_SA-2019-1159.NASL", "href": "https://www.tenable.com/plugins/nessus/123845", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123845);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-11813\"\n );\n\n script_name(english:\"EulerOS Virtualization 2.5.3 : libjpeg-turbo (EulerOS-SA-2019-1159)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the libjpeg-turbo package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.i1/4^CVE-2018-11813i1/4%0\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1159\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?62931140\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libjpeg-turbo package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.5.3\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.5.3\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.5.3\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"libjpeg-turbo-1.2.90-5.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T08:54:03", "description": "According to the version of the libjpeg-turbo packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.(CVE-2018-11813)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 15, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-09-27T00:00:00", "title": "EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2018-1298)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "modified": "2018-09-27T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:libjpeg-turbo-devel", "p-cpe:/a:huawei:euleros:libjpeg-turbo", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2018-1298.NASL", "href": "https://www.tenable.com/plugins/nessus/117742", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(117742);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-11813\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : libjpeg-turbo (EulerOS-SA-2018-1298)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the libjpeg-turbo packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.(CVE-2018-11813)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1298\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?cd1aa1fa\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libjpeg-turbo package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/09/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libjpeg-turbo-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"libjpeg-turbo-1.2.90-5.h1\",\n \"libjpeg-turbo-devel-1.2.90-5.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T08:54:03", "description": "According to the version of the libjpeg-turbo packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.(CVE-2018-11813)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 15, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-10-11T00:00:00", "title": "EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2018-1299)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "modified": "2018-10-11T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:libjpeg-turbo-devel", "p-cpe:/a:huawei:euleros:libjpeg-turbo", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2018-1299.NASL", "href": "https://www.tenable.com/plugins/nessus/118049", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(118049);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-11813\"\n );\n\n script_name(english:\"EulerOS 2.0 SP3 : libjpeg-turbo (EulerOS-SA-2018-1299)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the libjpeg-turbo packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.(CVE-2018-11813)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1299\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?0ba7872a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libjpeg-turbo package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/09/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/10/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libjpeg-turbo-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(3)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP3\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"libjpeg-turbo-1.2.90-5.h1\",\n \"libjpeg-turbo-devel-1.2.90-5.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"3\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T08:54:43", "description": "According to the version of the libjpeg-turbo package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.(CVE-2018-11813)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 17, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-03-08T00:00:00", "title": "EulerOS Virtualization 2.5.2 : libjpeg-turbo (EulerOS-SA-2019-1079)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "modified": "2019-03-08T00:00:00", "cpe": ["cpe:/o:huawei:euleros:uvp:2.5.2", "p-cpe:/a:huawei:euleros:libjpeg-turbo"], "id": "EULEROS_SA-2019-1079.NASL", "href": "https://www.tenable.com/plugins/nessus/122701", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(122701);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-11813\"\n );\n\n script_name(english:\"EulerOS Virtualization 2.5.2 : libjpeg-turbo (EulerOS-SA-2019-1079)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS Virtualization host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the libjpeg-turbo package installed, the\nEulerOS Virtualization installation on the remote host is affected by\nthe following vulnerability :\n\n - libjpeg 9c has a large loop because read_pixel in\n rdtarga.c mishandles EOF.(CVE-2018-11813)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1079\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?529b75a8\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libjpeg-turbo package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/08\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:uvp:2.5.2\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (uvp != \"2.5.2\") audit(AUDIT_OS_NOT, \"EulerOS Virtualization 2.5.2\");\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"libjpeg-turbo-1.2.90-5.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-07T10:16:01", "description": "Fix for **CVE-2018-11813**.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 11, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-01-03T00:00:00", "title": "Fedora 28 : libjpeg-turbo (2018-0e72ef852a)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813"], "modified": "2019-01-03T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:libjpeg-turbo", "cpe:/o:fedoraproject:fedora:28"], "id": "FEDORA_2018-0E72EF852A.NASL", "href": "https://www.tenable.com/plugins/nessus/120234", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2018-0e72ef852a.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(120234);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2018-11813\");\n script_xref(name:\"FEDORA\", value:\"2018-0e72ef852a\");\n\n script_name(english:\"Fedora 28 : libjpeg-turbo (2018-0e72ef852a)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix for **CVE-2018-11813**.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2018-0e72ef852a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libjpeg-turbo package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:28\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/06/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/06/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^28([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 28\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC28\", reference:\"libjpeg-turbo-1.5.3-5.fc28\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-14T06:18:02", "description": "This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\nCVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\nfunction which could allow to an attacker to cause denial of service\n(bsc#1128712).\n\nCVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\nrdtarga.c, which allowed remote attackers to cause a denial-of-service\nvia crafted JPG files due to a large loop (bsc#1096209)\n\nCVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\ncaused by a divide by zero when processing a crafted BMP image\n(bsc#1098155)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 18, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-05-01T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : libjpeg-turbo (SUSE-SU-2019:1111-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "modified": "2019-05-01T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libjpeg-turbo-debugsource", "p-cpe:/a:novell:suse_linux:libjpeg62-debuginfo", "p-cpe:/a:novell:suse_linux:libjpeg8-debuginfo", "p-cpe:/a:novell:suse_linux:libjpeg8", "p-cpe:/a:novell:suse_linux:libjpeg62-turbo-debugsource", "p-cpe:/a:novell:suse_linux:libturbojpeg0-debuginfo", "p-cpe:/a:novell:suse_linux:libturbojpeg0", "p-cpe:/a:novell:suse_linux:libjpeg-turbo", "p-cpe:/a:novell:suse_linux:libjpeg62", "p-cpe:/a:novell:suse_linux:libjpeg62-turbo", "p-cpe:/a:novell:suse_linux:libjpeg-turbo-debuginfo"], "id": "SUSE_SU-2019-1111-1.NASL", "href": "https://www.tenable.com/plugins/nessus/124453", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1111-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(124453);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\", \"CVE-2018-14498\");\n script_xref(name:\"TRA\", value:\"TRA-2018-17\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : libjpeg-turbo (SUSE-SU-2019:1111-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\nCVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\nfunction which could allow to an attacker to cause denial of service\n(bsc#1128712).\n\nCVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\nrdtarga.c, which allowed remote attackers to cause a denial-of-service\nvia crafted JPG files due to a large loop (bsc#1096209)\n\nCVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\ncaused by a divide by zero when processing a crafted BMP image\n(bsc#1098155)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1096209\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098155\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128712\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-1152/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-11813/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-14498/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191111-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8c6a9214\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.tenable.com/security/research/tra-2018-17\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t\npatch SUSE-SLE-SDK-12-SP4-2019-1111=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t\npatch SUSE-SLE-SDK-12-SP3-2019-1111=1\n\nSUSE Linux Enterprise Server 12-SP4:zypper in -t patch\nSUSE-SLE-SERVER-12-SP4-2019-1111=1\n\nSUSE Linux Enterprise Server 12-SP3:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2019-1111=1\n\nSUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP4-2019-1111=1\n\nSUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP3-2019-1111=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg-turbo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg8-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libturbojpeg0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libturbojpeg0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/06/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(3|4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP3/4\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(3|4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP3/4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg-turbo-debuginfo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg62-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg62-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg62-debuginfo-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg62-debuginfo-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg62-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg62-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg8-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg8-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg8-debuginfo-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjpeg8-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libturbojpeg0-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libturbojpeg0-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg-turbo-debuginfo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg62-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg62-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg62-debuginfo-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg62-debuginfo-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg62-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg62-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg8-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg8-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg8-debuginfo-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjpeg8-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libturbojpeg0-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libturbojpeg0-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg-turbo-debuginfo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg62-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg62-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg62-debuginfo-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg62-debuginfo-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg62-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg62-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg8-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg8-debuginfo-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg8-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libturbojpeg0-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libturbojpeg0-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg-turbo-debuginfo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg62-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg62-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg62-debuginfo-32bit-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg62-debuginfo-62.2.0-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg62-turbo-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg62-turbo-debugsource-1.5.3-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg8-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg8-debuginfo-32bit-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libjpeg8-debuginfo-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libturbojpeg0-8.1.2-31.14.2\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libturbojpeg0-debuginfo-8.1.2-31.14.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-14T06:17:29", "description": "This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\nCVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\nfunction which could allow to an attacker to cause denial of service\n(bsc#1128712).\n\nCVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\nrdtarga.c, which allowed remote attackers to cause a denial-of-service\nvia crafted JPG files due to a large loop (bsc#1096209)\n\nCVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\ncaused by a divide by zero when processing a crafted BMP image\n(bsc#1098155)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 18, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-03-25T00:00:00", "title": "SUSE SLED15 / SLES15 Security Update : libjpeg-turbo (SUSE-SU-2019:0711-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "modified": "2019-03-25T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libjpeg-turbo-debugsource", "cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:libjpeg62-debuginfo", "p-cpe:/a:novell:suse_linux:libjpeg8-debuginfo", "p-cpe:/a:novell:suse_linux:libjpeg8", "p-cpe:/a:novell:suse_linux:libjpeg62-devel", "p-cpe:/a:novell:suse_linux:libjpeg62-turbo-debugsource", "p-cpe:/a:novell:suse_linux:libturbojpeg0-debuginfo", "p-cpe:/a:novell:suse_linux:libjpeg8-devel", "p-cpe:/a:novell:suse_linux:libturbojpeg0", "p-cpe:/a:novell:suse_linux:libjpeg8-32bit-debuginfo", "p-cpe:/a:novell:suse_linux:libjpeg-turbo", "p-cpe:/a:novell:suse_linux:libjpeg62", "p-cpe:/a:novell:suse_linux:libjpeg62-turbo", "p-cpe:/a:novell:suse_linux:libjpeg-turbo-debuginfo"], "id": "SUSE_SU-2019-0711-1.NASL", "href": "https://www.tenable.com/plugins/nessus/123067", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:0711-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(123067);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/13\");\n\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\", \"CVE-2018-14498\");\n script_xref(name:\"TRA\", value:\"TRA-2018-17\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : libjpeg-turbo (SUSE-SU-2019:0711-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\nCVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\nfunction which could allow to an attacker to cause denial of service\n(bsc#1128712).\n\nCVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\nrdtarga.c, which allowed remote attackers to cause a denial-of-service\nvia crafted JPG files due to a large loop (bsc#1096209)\n\nCVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\ncaused by a divide by zero when processing a crafted BMP image\n(bsc#1098155)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1096209\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098155\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1128712\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-1152/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-11813/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-14498/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20190711-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?26a25d05\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.tenable.com/security/research/tra-2018-17\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Packagehub Subpackages 15:zypper in\n-t patch SUSE-SLE-Module-Packagehub-Subpackages-15-2019-711=1\n\nSUSE Linux Enterprise Module for Open Buildservice Development Tools\n15:zypper in -t patch\nSUSE-SLE-Module-Development-Tools-OBS-15-2019-711=1\n\nSUSE Linux Enterprise Module for Desktop Applications 15:zypper in -t\npatch SUSE-SLE-Module-Desktop-Applications-15-2019-711=1\n\nSUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-2019-711=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg-turbo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg62-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg8-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg8-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libturbojpeg0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libturbojpeg0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/06/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/03/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/03/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-debuginfo-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg-turbo-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg-turbo-debuginfo-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg-turbo-debugsource-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg62-62.2.0-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg62-debuginfo-62.2.0-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg62-devel-62.2.0-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg62-turbo-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg62-turbo-debugsource-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg8-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg8-debuginfo-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjpeg8-devel-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libturbojpeg0-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libturbojpeg0-debuginfo-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-debuginfo-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg-turbo-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg-turbo-debuginfo-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg-turbo-debugsource-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg62-62.2.0-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg62-debuginfo-62.2.0-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg62-devel-62.2.0-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg62-turbo-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg62-turbo-debugsource-1.5.3-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg8-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg8-debuginfo-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjpeg8-devel-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libturbojpeg0-8.1.2-5.7.1\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libturbojpeg0-debuginfo-8.1.2-5.7.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T12:41:28", "description": "This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in\n get_8bit_row function which could allow to an attacker\n to cause denial of service (bsc#1128712).\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in\n read_pixel in rdtarga.c, which allowed remote attackers\n to cause a denial-of-service via crafted JPG files due\n to a large loop (bsc#1096209)\n\n - CVE-2018-1152: Fixed a denial of service in\n start_input_bmp() rdbmp.c caused by a divide by zero\n when processing a crafted BMP image (bsc#1098155)\n\nThis update was imported from the SUSE:SLE-12:Update update project.", "edition": 15, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-05-09T00:00:00", "title": "openSUSE Security Update : libjpeg-turbo (openSUSE-2019-1343)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "modified": "2019-05-09T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libjpeg8", "p-cpe:/a:novell:opensuse:libjpeg62-turbo", "p-cpe:/a:novell:opensuse:libturbojpeg0-debuginfo", "p-cpe:/a:novell:opensuse:libturbojpeg0-32bit", "p-cpe:/a:novell:opensuse:libjpeg62-debuginfo", "p-cpe:/a:novell:opensuse:libjpeg8-devel", "p-cpe:/a:novell:opensuse:libjpeg8-devel-32bit", "p-cpe:/a:novell:opensuse:libjpeg62", "p-cpe:/a:novell:opensuse:libjpeg62-devel", "p-cpe:/a:novell:opensuse:libjpeg-turbo-debuginfo", "p-cpe:/a:novell:opensuse:libjpeg8-32bit", "p-cpe:/a:novell:opensuse:libturbojpeg0", "p-cpe:/a:novell:opensuse:libjpeg62-turbo-debugsource", "p-cpe:/a:novell:opensuse:libturbojpeg0-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libjpeg-turbo-debugsource", "p-cpe:/a:novell:opensuse:libjpeg62-devel-32bit", "p-cpe:/a:novell:opensuse:libjpeg-turbo", "cpe:/o:novell:opensuse:42.3", "p-cpe:/a:novell:opensuse:libjpeg62-32bit", "p-cpe:/a:novell:opensuse:libjpeg8-debuginfo", "p-cpe:/a:novell:opensuse:libjpeg62-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libjpeg8-debuginfo-32bit"], "id": "OPENSUSE-2019-1343.NASL", "href": "https://www.tenable.com/plugins/nessus/124708", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-1343.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(124708);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\", \"CVE-2018-14498\");\n script_xref(name:\"TRA\", value:\"TRA-2018-17\");\n\n script_name(english:\"openSUSE Security Update : libjpeg-turbo (openSUSE-2019-1343)\");\n script_summary(english:\"Check for the openSUSE-2019-1343 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in\n get_8bit_row function which could allow to an attacker\n to cause denial of service (bsc#1128712).\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in\n read_pixel in rdtarga.c, which allowed remote attackers\n to cause a denial-of-service via crafted JPG files due\n to a large loop (bsc#1096209)\n\n - CVE-2018-1152: Fixed a denial of service in\n start_input_bmp() rdbmp.c caused by a divide by zero\n when processing a crafted BMP image (bsc#1098155)\n\nThis update was imported from the SUSE:SLE-12:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1096209\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1098155\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128712\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.tenable.com/security/research/tra-2018-17\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libjpeg-turbo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg-turbo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/06/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg-turbo-1.5.3-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg-turbo-debuginfo-1.5.3-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg-turbo-debugsource-1.5.3-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg62-62.2.0-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg62-debuginfo-62.2.0-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg62-devel-62.2.0-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg62-turbo-1.5.3-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg62-turbo-debugsource-1.5.3-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg8-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg8-debuginfo-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libjpeg8-devel-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libturbojpeg0-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libturbojpeg0-debuginfo-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libjpeg62-32bit-62.2.0-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libjpeg62-debuginfo-32bit-62.2.0-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libjpeg62-devel-32bit-62.2.0-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libjpeg8-debuginfo-32bit-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libjpeg8-devel-32bit-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libturbojpeg0-32bit-8.1.2-45.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libturbojpeg0-debuginfo-32bit-8.1.2-45.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo / libjpeg-turbo-debuginfo / libjpeg-turbo-debugsource / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T12:40:41", "description": "This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in\n get_8bit_row function which could allow to an attacker\n to cause denial of service (bsc#1128712).\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in\n read_pixel in rdtarga.c, which allowed remote attackers\n to cause a denial-of-service via crafted JPG files due\n to a large loop (bsc#1096209)\n\n - CVE-2018-1152: Fixed a denial of service in\n start_input_bmp() rdbmp.c caused by a divide by zero\n when processing a crafted BMP image (bsc#1098155)\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "edition": 15, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2019-04-03T00:00:00", "title": "openSUSE Security Update : libjpeg-turbo (openSUSE-2019-1118)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "modified": "2019-04-03T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libjpeg8", "p-cpe:/a:novell:opensuse:libjpeg62-turbo", "p-cpe:/a:novell:opensuse:libjpeg62-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libturbojpeg0-debuginfo", "p-cpe:/a:novell:opensuse:libturbojpeg0-32bit", "p-cpe:/a:novell:opensuse:libjpeg62-debuginfo", "cpe:/o:novell:opensuse:15.0", "p-cpe:/a:novell:opensuse:libjpeg8-devel", "p-cpe:/a:novell:opensuse:libjpeg8-devel-32bit", "p-cpe:/a:novell:opensuse:libjpeg62", "p-cpe:/a:novell:opensuse:libjpeg62-devel", "p-cpe:/a:novell:opensuse:libjpeg-turbo-debuginfo", "p-cpe:/a:novell:opensuse:libjpeg8-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libjpeg8-32bit", "p-cpe:/a:novell:opensuse:libturbojpeg0", "p-cpe:/a:novell:opensuse:libjpeg62-turbo-debugsource", "p-cpe:/a:novell:opensuse:libjpeg-turbo-debugsource", "p-cpe:/a:novell:opensuse:libjpeg62-devel-32bit", "p-cpe:/a:novell:opensuse:libjpeg-turbo", "p-cpe:/a:novell:opensuse:libjpeg62-32bit", "p-cpe:/a:novell:opensuse:libturbojpeg0-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libjpeg8-debuginfo"], "id": "OPENSUSE-2019-1118.NASL", "href": "https://www.tenable.com/plugins/nessus/123665", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-1118.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(123665);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2018-1152\", \"CVE-2018-11813\", \"CVE-2018-14498\");\n script_xref(name:\"TRA\", value:\"TRA-2018-17\");\n\n script_name(english:\"openSUSE Security Update : libjpeg-turbo (openSUSE-2019-1118)\");\n script_summary(english:\"Check for the openSUSE-2019-1118 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for libjpeg-turbo fixes the following issues :\n\nThe following security vulnerabilities were addressed :\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in\n get_8bit_row function which could allow to an attacker\n to cause denial of service (bsc#1128712).\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in\n read_pixel in rdtarga.c, which allowed remote attackers\n to cause a denial-of-service via crafted JPG files due\n to a large loop (bsc#1096209)\n\n - CVE-2018-1152: Fixed a denial of service in\n start_input_bmp() rdbmp.c caused by a divide by zero\n when processing a crafted BMP image (bsc#1098155)\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1096209\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1098155\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1128712\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.tenable.com/security/research/tra-2018-17\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libjpeg-turbo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg-turbo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-turbo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg62-turbo-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjpeg8-devel-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libturbojpeg0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/06/06\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/04/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/04/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg-turbo-1.5.3-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg-turbo-debuginfo-1.5.3-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg-turbo-debugsource-1.5.3-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg62-62.2.0-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg62-debuginfo-62.2.0-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg62-devel-62.2.0-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg62-turbo-1.5.3-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg62-turbo-debugsource-1.5.3-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg8-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg8-debuginfo-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjpeg8-devel-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libturbojpeg0-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libturbojpeg0-debuginfo-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjpeg62-32bit-62.2.0-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjpeg62-32bit-debuginfo-62.2.0-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjpeg62-devel-32bit-62.2.0-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjpeg8-32bit-debuginfo-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjpeg8-devel-32bit-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libturbojpeg0-32bit-8.1.2-lp150.4.3.2\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libturbojpeg0-32bit-debuginfo-8.1.2-lp150.4.3.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjpeg-turbo / libjpeg-turbo-debuginfo / libjpeg-turbo-debugsource / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2021-01-20T14:53:39", "description": "This update for jpeg fixes the following issues :\n\n - CVE-2017-15232: NULL pointer dereferences in jdpostct.c\n and jquant1.c could lead to denial of service (crash)\n when processing images [bsc#1062937]\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in\n read_pixel in rdtarga.c, which allowed remote attackers\n to cause a denial-of-service via crafted JPG files due\n to a large loop [bsc#1096209]\n\n - CVE-2018-1152: Fixed a denial of service in\n start_input_bmp() rdbmp.c caused by a divide by zero\n when processing a crafted BMP image [bsc#1098155]\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 26, "cvss3": {"score": 7.5, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "published": "2018-06-28T00:00:00", "title": "SUSE SLES11 Security Update : jpeg (SUSE-SU-2018:1825-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2017-15232"], "modified": "2018-06-28T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:11", "p-cpe:/a:novell:suse_linux:libjpeg", "p-cpe:/a:novell:suse_linux:jpeg"], "id": "SUSE_SU-2018-1825-1.NASL", "href": "https://www.tenable.com/plugins/nessus/110762", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:1825-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(110762);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2017-15232\", \"CVE-2018-1152\", \"CVE-2018-11813\");\n script_xref(name:\"TRA\", value:\"TRA-2018-17\");\n\n script_name(english:\"SUSE SLES11 Security Update : jpeg (SUSE-SU-2018:1825-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for jpeg fixes the following issues :\n\n - CVE-2017-15232: NULL pointer dereferences in jdpostct.c\n and jquant1.c could lead to denial of service (crash)\n when processing images [bsc#1062937]\n\n - CVE-2018-11813: Fixed the end-of-file mishandling in\n read_pixel in rdtarga.c, which allowed remote attackers\n to cause a denial-of-service via crafted JPG files due\n to a large loop [bsc#1096209]\n\n - CVE-2018-1152: Fixed a denial of service in\n start_input_bmp() rdbmp.c caused by a divide by zero\n when processing a crafted BMP image [bsc#1098155]\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1062937\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1096209\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098155\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-15232/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-1152/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-11813/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20181825-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d2be5bdd\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.tenable.com/security/research/tra-2018-17\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t\npatch sdksp4-jpeg-13681=1\n\nSUSE Linux Enterprise Server 11-SP4:zypper in -t patch\nslessp4-jpeg-13681=1\n\nSUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch\ndbgsp4-jpeg-13681=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:ND\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:X\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:jpeg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjpeg\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/10/11\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/06/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/06/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"libjpeg-32bit-6.2.0-879.12.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"s390x\", reference:\"libjpeg-32bit-6.2.0-879.12.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"jpeg-6b-879.12.7.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"libjpeg-6.2.0-879.12.7.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jpeg\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2018-1152", "CVE-2018-11813"], "description": "The libjpeg-turbo package contains a library of functions for manipulating JPEG images. ", "modified": "2018-07-11T20:22:53", "published": "2018-07-11T20:22:53", "id": "FEDORA:DED716372194", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: libjpeg-turbo-1.5.3-6.fc28", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:55", "bulletinFamily": "unix", "cvelist": ["CVE-2018-1152", "CVE-2018-11813", "CVE-2018-14498"], "description": "The libjpeg-turbo package contains a library of functions for manipulating JPEG images. ", "modified": "2019-03-29T02:04:54", "published": "2019-03-29T02:04:54", "id": "FEDORA:C68806048D43", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 28 Update: libjpeg-turbo-1.5.3-7.fc28", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "suse": [{"lastseen": "2019-05-08T16:20:31", "bulletinFamily": "unix", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "description": "This update for libjpeg-turbo fixes the following issues:\n\n The following security vulnerabilities were addressed:\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\n function which could allow to an attacker to cause denial of service\n (bsc#1128712).\n - CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\n rdtarga.c, which allowed remote attackers to cause a denial-of-service\n via crafted JPG files due to a large loop (bsc#1096209)\n - CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\n caused by a divide by zero when processing a crafted BMP image\n (bsc#1098155)\n\n This update was imported from the SUSE:SLE-12:Update update project.\n\n", "edition": 1, "modified": "2019-05-08T15:12:31", "published": "2019-05-08T15:12:31", "id": "OPENSUSE-SU-2019:1343-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00015.html", "title": "Security update for libjpeg-turbo (moderate)", "type": "suse", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-04-02T21:07:40", "bulletinFamily": "unix", "cvelist": ["CVE-2018-11813", "CVE-2018-1152", "CVE-2018-14498"], "description": "This update for libjpeg-turbo fixes the following issues:\n\n The following security vulnerabilities were addressed:\n\n - CVE-2018-14498: Fixed a heap-based buffer over read in get_8bit_row\n function which could allow to an attacker to cause denial of service\n (bsc#1128712).\n - CVE-2018-11813: Fixed the end-of-file mishandling in read_pixel in\n rdtarga.c, which allowed remote attackers to cause a denial-of-service\n via crafted JPG files due to a large loop (bsc#1096209)\n - CVE-2018-1152: Fixed a denial of service in start_input_bmp() rdbmp.c\n caused by a divide by zero when processing a crafted BMP image\n (bsc#1098155)\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n", "edition": 1, "modified": "2019-04-02T18:27:28", "published": "2019-04-02T18:27:28", "id": "OPENSUSE-SU-2019:1118-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.html", "title": "Security update for libjpeg-turbo (moderate)", "type": "suse", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "amazon": [{"lastseen": "2020-11-10T12:36:37", "bulletinFamily": "unix", "cvelist": ["CVE-2016-3616", "CVE-2018-11813", "CVE-2018-11214", "CVE-2018-11212", "CVE-2018-11213", "CVE-2018-14498"], "description": "**Issue Overview:**\n\nThe cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.([CVE-2016-3616 __](<https://access.redhat.com/security/cve/CVE-2016-3616>))\n\nA divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file. \n[CVE-2018-11212 __](<https://access.redhat.com/security/cve/CVE-2018-11212>))\n\nAn out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.([CVE-2018-11213 __](<https://access.redhat.com/security/cve/CVE-2018-11213>))\n\nAn out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.([CVE-2018-11214 __](<https://access.redhat.com/security/cve/CVE-2018-11214>))\n\nlibjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.([CVE-2018-11813 __](<https://access.redhat.com/security/cve/CVE-2018-11813>))\n\nget_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.([CVE-2018-14498 __](<https://access.redhat.com/security/cve/CVE-2018-14498>))\n\n \n**Affected Packages:** \n\n\nlibjpeg-turbo\n\n \n**Issue Correction:** \nRun _yum update libjpeg-turbo_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n aarch64: \n libjpeg-turbo-1.2.90-6.amzn2.0.3.aarch64 \n libjpeg-turbo-devel-1.2.90-6.amzn2.0.3.aarch64 \n libjpeg-turbo-utils-1.2.90-6.amzn2.0.3.aarch64 \n libjpeg-turbo-static-1.2.90-6.amzn2.0.3.aarch64 \n turbojpeg-1.2.90-6.amzn2.0.3.aarch64 \n turbojpeg-devel-1.2.90-6.amzn2.0.3.aarch64 \n libjpeg-turbo-debuginfo-1.2.90-6.amzn2.0.3.aarch64 \n \n i686: \n libjpeg-turbo-1.2.90-6.amzn2.0.3.i686 \n libjpeg-turbo-devel-1.2.90-6.amzn2.0.3.i686 \n libjpeg-turbo-utils-1.2.90-6.amzn2.0.3.i686 \n libjpeg-turbo-static-1.2.90-6.amzn2.0.3.i686 \n turbojpeg-1.2.90-6.amzn2.0.3.i686 \n turbojpeg-devel-1.2.90-6.amzn2.0.3.i686 \n libjpeg-turbo-debuginfo-1.2.90-6.amzn2.0.3.i686 \n \n src: \n libjpeg-turbo-1.2.90-6.amzn2.0.3.src \n \n x86_64: \n libjpeg-turbo-1.2.90-6.amzn2.0.3.x86_64 \n libjpeg-turbo-devel-1.2.90-6.amzn2.0.3.x86_64 \n libjpeg-turbo-utils-1.2.90-6.amzn2.0.3.x86_64 \n libjpeg-turbo-static-1.2.90-6.amzn2.0.3.x86_64 \n turbojpeg-1.2.90-6.amzn2.0.3.x86_64 \n turbojpeg-devel-1.2.90-6.amzn2.0.3.x86_64 \n libjpeg-turbo-debuginfo-1.2.90-6.amzn2.0.3.x86_64 \n \n \n", "edition": 1, "modified": "2019-11-04T22:23:00", "published": "2019-11-04T22:23:00", "id": "ALAS2-2019-1350", "href": "https://alas.aws.amazon.com/AL2/ALAS-2019-1350.html", "title": "Medium: libjpeg-turbo", "type": "amazon", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-11-10T12:34:38", "bulletinFamily": "unix", "cvelist": ["CVE-2016-3616", "CVE-2018-11813", "CVE-2018-11214", "CVE-2018-11212", "CVE-2018-11213", "CVE-2018-14498"], "description": "**Issue Overview:**\n\nThe cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.([CVE-2016-3616 __](<https://access.redhat.com/security/cve/CVE-2016-3616>))\n\nlibjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.([CVE-2018-11813 __](<https://access.redhat.com/security/cve/CVE-2018-11813>))\n\nAn out-of-bounds read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PPM file. An attacker could use this flaw to crash the application and cause a denial of service.([CVE-2018-11214 __](<https://access.redhat.com/security/cve/CVE-2018-11214>))\n\nAn out-of-bound read vulnerability has been discovered in libjpeg-turbo when reading one row of pixels of a PGM file. An attacker could use this flaw to crash the application and cause a denial of service.([CVE-2018-11213 __](<https://access.redhat.com/security/cve/CVE-2018-11213>))\n\nget_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.([CVE-2018-14498 __](<https://access.redhat.com/security/cve/CVE-2018-14498>))\n\nA divide by zero vulnerability has been discovered in libjpeg-turbo in alloc_sarray function of jmemmgr.c file. An attacker could use this vulnerability to cause a denial of service via a crafted file.([CVE-2018-11212 __](<https://access.redhat.com/security/cve/CVE-2018-11212>))\n\n \n**Affected Packages:** \n\n\nlibjpeg-turbo\n\n \n**Issue Correction:** \nRun _yum update libjpeg-turbo_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n turbojpeg-devel-1.2.90-8.16.amzn1.i686 \n turbojpeg-1.2.90-8.16.amzn1.i686 \n libjpeg-turbo-utils-1.2.90-8.16.amzn1.i686 \n libjpeg-turbo-1.2.90-8.16.amzn1.i686 \n libjpeg-turbo-static-1.2.90-8.16.amzn1.i686 \n libjpeg-turbo-debuginfo-1.2.90-8.16.amzn1.i686 \n libjpeg-turbo-devel-1.2.90-8.16.amzn1.i686 \n \n src: \n libjpeg-turbo-1.2.90-8.16.amzn1.src \n \n x86_64: \n libjpeg-turbo-static-1.2.90-8.16.amzn1.x86_64 \n libjpeg-turbo-devel-1.2.90-8.16.amzn1.x86_64 \n libjpeg-turbo-debuginfo-1.2.90-8.16.amzn1.x86_64 \n libjpeg-turbo-utils-1.2.90-8.16.amzn1.x86_64 \n libjpeg-turbo-1.2.90-8.16.amzn1.x86_64 \n turbojpeg-devel-1.2.90-8.16.amzn1.x86_64 \n turbojpeg-1.2.90-8.16.amzn1.x86_64 \n \n \n", "edition": 3, "modified": "2019-09-13T22:58:00", "published": "2019-09-13T22:58:00", "id": "ALAS-2019-1286", "href": "https://alas.aws.amazon.com/ALAS-2019-1286.html", "title": "Medium: libjpeg-turbo", "type": "amazon", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2019-08-15T00:45:17", "bulletinFamily": "unix", "cvelist": ["CVE-2016-3616", "CVE-2018-11212", "CVE-2018-11213", "CVE-2018-11214", "CVE-2018-11813", "CVE-2018-14498"], "description": "The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)\n\n* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)\n\n* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)\n\n* libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)\n\n* libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)\n\n* libjpeg: \"cjpeg\" utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.", "modified": "2019-08-06T13:42:58", "published": "2019-08-06T11:55:58", "id": "RHSA-2019:2052", "href": "https://access.redhat.com/errata/RHSA-2019:2052", "type": "redhat", "title": "(RHSA-2019:2052) Moderate: libjpeg-turbo security update", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "oraclelinux": [{"lastseen": "2019-08-14T08:39:29", "bulletinFamily": "unix", "cvelist": ["CVE-2016-3616", "CVE-2018-11813", "CVE-2018-11214", "CVE-2018-11212", "CVE-2018-11213", "CVE-2018-14498"], "description": "[1.2.90-8]\n- Fix CVE-2018-14498 (#1687475)\n[1.2.90-7]\n- Fix CVE-2018-11212 (#1586062)\n- Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091)\n and CVE-2018-11214 (#1589110)\n- Fix CVE-2018-11813 (#1591203)", "edition": 1, "modified": "2019-08-13T00:00:00", "published": "2019-08-13T00:00:00", "id": "ELSA-2019-2052", "href": "http://linux.oracle.com/errata/ELSA-2019-2052.html", "title": "libjpeg-turbo security update", "type": "oraclelinux", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "centos": [{"lastseen": "2019-12-20T18:28:43", "bulletinFamily": "unix", "cvelist": ["CVE-2016-3616", "CVE-2018-11813", "CVE-2018-11214", "CVE-2018-11212", "CVE-2018-11213", "CVE-2018-14498"], "description": "**CentOS Errata and Security Advisory** CESA-2019:2052\n\n\nThe libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance.\n\nSecurity Fix(es):\n\n* libjpeg: null pointer dereference in cjpeg (CVE-2016-3616)\n\n* libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service (CVE-2018-14498)\n\n* libjpeg-turbo: Divide By Zero in alloc_sarray function in jmemmgr.c (CVE-2018-11212)\n\n* libjpeg: Segmentation fault in get_text_gray_row function in rdppm.c (CVE-2018-11213)\n\n* libjpeg: Segmentation fault in get_text_rgb_row function in rdppm.c (CVE-2018-11214)\n\n* libjpeg: \"cjpeg\" utility large loop because read_pixel in rdtarga.c mishandles EOF (CVE-2018-11813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2019-August/005951.html\n\n**Affected packages:**\nlibjpeg-turbo\nlibjpeg-turbo-devel\nlibjpeg-turbo-static\nlibjpeg-turbo-utils\nturbojpeg\nturbojpeg-devel\n\n**Upstream details at:**\n", "edition": 2, "modified": "2019-08-30T03:16:23", "published": "2019-08-30T03:16:23", "id": "CESA-2019:2052", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2019-August/005951.html", "title": "libjpeg, turbojpeg security update", "type": "centos", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}
