NULL pointer dereference in libjpeg-turbo - CVE-2017-15232

Vulnerability identifier: #VU33231

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15232

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted JPEG file.

libjpeg-turbo
libjpeg-turbo (Alpine package)
Dynamic System Analysis (DSA) Preboot
Flex System Chassis Management Module (CMM)

Update to version 1.5.3.

libjpeg-turbo - update to 1.5.3
libjpeg-turbo (Alpine package) - update to 1.5.3-r0
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
Flex System Chassis Management Module (CMM) - update to 2pet16d-2.5.13d

• https://github.com/libjpeg-turbo/libjpeg-turbo/pull/182
• https://github.com/mozilla/mozjpeg/issues/268
• https://usn.ubuntu.com/3706-1/

• NULL pointer dereference in libjpeg-turbo
• NULL pointer dereference in libjpeg-turbo (Alpine package)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)