Denial of Service Vulnerability in libjpeg-turbo: CVE-2018-1152
Summary
ALPINE-CVE-2018-1152: libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. Affects libjpeg-turbo versions < 1.5.3-r2. Fixed in 1.5.3-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libjpeg-turbo is a widely used library for handling JPEG images, offering high-performance image compression and decompression. It is optimized for speed and is often utilized in various applications that require efficient image processing. However, it has been identified to have a vulnerability that can lead to denial of service under specific conditions.
Vulnerability Detail
libjpeg-turbo version 1.5.90 is susceptible to a denial of service vulnerability caused by a divide by zero error when processing a specially crafted BMP image. This vulnerability can be exploited by an attacker to crash the application using the library, leading to service interruptions and potential data loss. The issue arises from improper handling of certain image formats, which can be manipulated to trigger the flaw.
How To Fix
Minimum fixed version
1.5.3-r2
This is the first release that contains the fix.
sudo apk add --upgrade libjpeg-turboTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider implementing input validation to reject any BMP images that do not meet expected criteria, thereby mitigating the risk of exploitation until a patch can be applied.
Conclusion
The vulnerability identified as CVE-2018-1152 in libjpeg-turbo poses a significant risk of denial of service through the processing of crafted BMP images. It is crucial to update to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for libjpeg-turbo →
FAQ
CVE-2018-1152 is a vulnerability in libjpeg-turbo that allows for denial of service due to a divide by zero error when processing certain BMP images.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
Implement input validation to reject any malformed BMP images as a temporary workaround until you can apply the patch.
You can find more information about libjpeg-turbo on its official website or its repository on GitHub.
References
Related vulnerabilities
Recent vulnerabilities recorded for libjpeg-turbo.
