CVE-2018-14498 — Out-of-bounds Read in Libjpeg-turbo

CWE-125 — Out-of-bounds Read15 documents8 sources
Severity
6.5MEDIUMNVD
OSV7.5
EPSS
0.3%
top 46.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Libjpeg-turboDebian Libjpeg-turboMozilla Mozjpeg+3 more
Timeline
PublishedMar 7
Latest updateJun 30

Description

get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶debiandebian/libjpeg-turbo< libjpeg-turbo 1:2.0.5-1 (bookworm)
▶Debianlibjpeg-turbo/libjpeg-turbo< 1:2.0.5-1+3
▶Ubuntulibjpeg-turbo/libjpeg-turbo< 1.4.2-0ubuntu3.3+3
▶NVDmozilla/mozjpeg3.3.1

Also affects: Debian Linux 8.0, Fedora 28

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
libjpeg-turbo vulnerabilities↗2022-08-08
▶
GHSA
GHSA-jg8v-w7gx-4g68: get_8bit_row in rdbmp↗2022-05-13
▶
OSV
libjpeg-turbo vulnerabilities↗2019-11-13
▶
OSV
CVE-2018-14498: get_8bit_row in rdbmp↗2019-03-07
▶

📋Vendor Advisories

4
Ubuntu
libjpeg-turbo vulnerabilities↗2022-08-08
▶
Ubuntu
libjpeg-turbo vulnerabilities↗2019-11-13
▶
Red Hat
libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service↗2018-07-20
▶
Debian
CVE-2018-14498: libjpeg-turbo - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3....↗2018
▶

📄Research Papers

2
arXiv
Fuzzing: Randomness? Reasoning! Efficient Directed Fuzzing via Large Language Models↗2025-06-30
▶
arXiv
Dissecting contact tracing apps in the Android platform↗2021-05-21
▶

💬Community

4
Bugzilla
CVE-2018-14498 mingw-libjpeg-turbo: libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service [epel-7]↗2019-03-11
▶
Bugzilla
CVE-2018-14498 libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service↗2019-03-11
▶
Bugzilla
CVE-2018-14498 libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service [fedora-28]↗2019-03-11
▶
Bugzilla
CVE-2018-14498 mingw-libjpeg-turbo: libjpeg-turbo: heap-based buffer over-read via crafted 8-bit BMP in get_8bit_row in rdbmp.c leads to denial of service [fedora-28]↗2019-03-11
▶