An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Canonical
  • Ubuntu Linux
Debian
  • Debian Linux
Ijg
  • Libjpeg
Netapp
  • Oncommand Unified Manager
  • Oncommand Workflow Automation
  • Snapmanager
Opensuse
  • Leap
Oracle
  • Jdk
  • Jre
Redhat
  • Enterprise Linux
  • Enterprise Linux Desktop
  • Enterprise Linux Server
  • Enterprise Linux Workstation
  • Network Satellite
  • Rhel Extras
  • Satellite

Configuration 1 [-]

cpe:2.3:a:ijg:libjpeg:9a:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Configuration 4 [-]

OR cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:*
cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:*

Configuration 5 [-]

OR cpe:2.3:a:oracle:jdk:1.7.0:update201:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update192:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:8.0:update_191:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 7 [-]

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 6 Supplementary
java-1.8.0-ibm-1:1.8.0.5.30-1jpp.1.el6_10 cpe:/a:redhat:rhel_extras:6 RHSA-2019:0469 2019-03-06T00:00:00Z
java-1.7.1-ibm-1:1.7.1.4.40-1jpp.1.el6_10 cpe:/a:redhat:rhel_extras:6 RHSA-2019:0474 2019-03-07T00:00:00Z
Red Hat Enterprise Linux 7
libjpeg-turbo-0:1.2.90-8.el7 cpe:/o:redhat:enterprise_linux:7 RHSA-2019:2052 2019-08-06T00:00:00Z
Red Hat Enterprise Linux 7 Supplementary
java-1.8.0-ibm-1:1.8.0.5.30-1jpp.1.el7 cpe:/a:redhat:rhel_extras:7 RHSA-2019:0472 2019-03-08T00:00:00Z
java-1.7.1-ibm-1:1.7.1.4.40-1jpp.1.el7 cpe:/a:redhat:rhel_extras:7 RHSA-2019:0473 2019-03-08T00:00:00Z
Red Hat Enterprise Linux 8
java-1.8.0-ibm-1:1.8.0.5.35-3.el8_0 cpe:/a:redhat:enterprise_linux:8::supplementary RHSA-2019:1238 2019-05-16T00:00:00Z
Red Hat Satellite 5.8
java-1.8.0-ibm-1:1.8.0.5.30-1jpp.1.el6_10 cpe:/a:redhat:network_satellite:5.8::el6 RHSA-2019:0640 2019-03-25T00:00:00Z
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html cve-icon cve-icon
http://www.ijg.org/ cve-icon cve-icon
http://www.securityfocus.com/bid/106583 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0469 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0472 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0473 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0474 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:0640 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:1238 cve-icon cve-icon
https://access.redhat.com/errata/RHSA-2019:2052 cve-icon cve-icon
https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a cve-icon cve-icon
https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2018-11212 cve-icon
https://security.netapp.com/advisory/ntap-20190118-0001/ cve-icon cve-icon
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us cve-icon cve-icon
https://usn.ubuntu.com/3706-1/ cve-icon cve-icon
https://usn.ubuntu.com/3706-2/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2018-11212 cve-icon
https://www.oracle.com/security-alerts/cpuapr2022.html cve-icon cve-icon
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html cve-icon cve-icon
History

Thu, 15 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-05-16T17:00:00.000Z

Updated: 2026-10-15T17:20:54.530Z

Reserved: 2018-05-16T00:00:00.000Z

Link: CVE-2018-11212

cve-icon Vulnrichment

Updated: 2024-08-05T08:01:52.817Z

cve-icon NVD

Status : Modified

Published: 2018-05-16T17:29:00.230

Modified: 2026-10-15T18:17:07.450

Link: CVE-2018-11212

cve-icon Redhat

Severity : Low

Publid Date: 2018-05-16T00:00:00Z

Links: CVE-2018-11212 - Bugzilla