Ubuntu.comUB:CVE-2017-9614CVE-2017-9614
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.016 Low
EPSS
Percentile
87.4%
DISPUTED The fill_input_buffer function in jdatasrc.c in
libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service
(invalid memory access and application crash) or possibly have unspecified
other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is
due to a bug in downstream code caused by misuse of the libjpeg API.
Bugs
- <https://github.com/libjpeg-turbo/libjpeg-turbo/issues/167>
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869927>
Notes
| Author | Note |
|---|---|
| mdeslaur | this isn’t actually a security issue in libjpeg-turbo, it is a bad usage of the API. See upstream bug. |
Related
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.016 Low
EPSS
Percentile
87.4%