CVE编号
CVE-2018-11212利用情况
暂无补丁情况
官方补丁披露时间
2018-05-17漏洞描述
在libjpeg 9a中发现了一个问题。 jmemmgr.c中的alloc_sarray函数允许远程攻击者通过精心制作的文件导致拒绝服务（被零除错误）。解决建议
厂商尚未提供漏洞修复方案，请关注厂商主页更新：http://libjpeg.sourceforge.net/
参考链接 |
|
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html | |
| http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html | |
| http://www.ijg.org/ | |
| http://www.securityfocus.com/bid/106583 | |
| https://access.redhat.com/errata/RHSA-2019:0469 | |
| https://access.redhat.com/errata/RHSA-2019:0472 | |
| https://access.redhat.com/errata/RHSA-2019:0473 | |
| https://access.redhat.com/errata/RHSA-2019:0474 | |
| https://access.redhat.com/errata/RHSA-2019:0640 | |
| https://access.redhat.com/errata/RHSA-2019:1238 | |
| https://access.redhat.com/errata/RHSA-2019:2052 | |
| https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a | |
| https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git | |
| https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html | |
| https://security.netapp.com/advisory/ntap-20190118-0001/ | |
| https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-... | |
| https://usn.ubuntu.com/3706-1/ | |
| https://usn.ubuntu.com/3706-2/ | |
| https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | ijg | libjpeg | 9a | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | netapp | oncommand_unified_manager | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | netapp | oncommand_unified_manager | * |
From (including) 7.3 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | netapp | oncommand_unified_manager | * |
From (including) 9.4 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | netapp | oncommand_workflow_automation | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | netapp | snapmanager | * | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | jdk | 1.7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | jdk | 1.8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | jdk | 11.0.1 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | jre | 8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | satellite | 5.8 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | alibaba_cloud_linux_2.1903 | libjpeg-turbo | * |
Up to (excluding) 1.2.90-8.1.al7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | libjpeg6b | * |
Up to (excluding) 8.201.08-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | libjpeg6b | * |
Up to (excluding) 8.201.08-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.6 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | libjpeg-turbo | * |
Up to (excluding) 7.211.2.6.17-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | libjpeg-turbo | * |
Up to (excluding) 1.2.90-6.amzn2.0.3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | libjpeg-turbo | * |
Up to (excluding) 1.2.90-8.16.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | libjpeg6b | * |
Up to (excluding) 1.8.0.5.35-3.el8_0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | libjpeg-turbo | * |
Up to (excluding) 1:1.3.1-12+deb8u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | libjpeg-turbo | * |
Up to (excluding) 1.8.0.201-lp150.2.12.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.3 | libjpeg-turbo | * |
Up to (excluding) 1.8.0.212-34.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | libjpeg-turbo | * |
Up to (excluding) 1.2.90-8.el7 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | libjpeg6b | * |
Up to (excluding) 1.8.0.5.35-3.el8_0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_11_SP4 | libjpeg-turbo | * |
Up to (excluding) 1.7.1_sr4.40-26.36.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP3 | libjpeg-turbo | * |
Up to (excluding) 1.7.0.221-43.22.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | libjpeg-turbo | * |
Up to (excluding) 1.7.0.221-43.22.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | libjpeg-turbo | * |
Up to (excluding) 1.8.0_sr5.40-30.54.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04 | libjpeg6b | * |
Up to (excluding) 1.3.0-0ubuntu2.1 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...