CVE-2018-11212: canonical ubuntu_linux Divide By Zero
CVSS: 6.5v3.0MediumModified
AliasesUBUNTU-CVE-2018-11212DEBIAN-CVE-2018-11212CGA-6qc5-w63x-x69xCGA-8h4w-w67j-jw7mCGA-j847-h893-45gjCGA-wmcc-qwjh-vc4fCGA-24q8-8wr6-f95xCGA-2jgc-22fv-2wvfCGA-2wh7-f8f5-86c7CGA-3rww-76rm-qm8rCGA-463f-6w5x-3mq5CGA-4fv3-2fxw-57jgCGA-6vm4-rcvq-hh8fCGA-7cj9-qvh8-286vCGA-7p66-rfcg-8f5hCGA-85p8-q748-6qj4CGA-8m3w-chvm-2h45CGA-8mmp-3vpg-f6m3CGA-9964-chvx-gjrrCGA-cpfv-62jv-r9q9CGA-g4p9-v6hx-w78gCGA-g7rj-hvf4-6mghCGA-hh6x-2g3j-4g39CGA-hj69-h342-jcfmCGA-hvch-mr9x-568gCGA-hw2f-x72c-wvqjCGA-jg8q-2hj5-mmf9CGA-jjx8-rx9p-gxqcCGA-jjxc-8r39-739qCGA-jpf8-m53x-j5g2CGA-pj9g-ch8g-g42rCGA-pxc5-f97x-hm5hCGA-q93w-h93q-23gjCGA-r6qw-5wpp-mg88CGA-ww2r-8vcp-gf3vCGA-x88c-x2ph-6jcqCGA-x8c9-28pw-758hCGA-xx7w-57jp-fcgg
Published 16-05-2018Last modified 15-10-2026
Vulnerability summary
CVE-2018-11212 is a medium (CVSS 6.5) Divide By Zero vulnerability in canonical ubuntu_linux. EPSS estimates a 4.83% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
6.5/10
010
Medium · v3.0 (NVD)EPSS score
4.83%
0%100%
Low · -0.18 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 28 · Related 24DLA-1638-1MGASA-2019-0071OPENSUSE-SU-2019:0346-1OPENSUSE-SU-2024:10871-1OPENSUSE-SU-2024:10872-1OPENSUSE-SU-2024:10873-1OPENSUSE-SU-2024:10876-1RHSA-2019:0469RHSA-2019:0472RHSA-2019:0473RHSA-2019:0474RHSA-2019:0640RHSA-2019:1238RHSA-2019:2052SUSE-SU-2019:0574-1SUSE-SU-2019:0585-1SUSE-SU-2019:0604-1SUSE-SU-2019:0617-1SUSE-SU-2019:1219-1SUSE-SU-2019:1392-1SUSE-SU-2019:13975-1SUSE-SU-2019:13978-1SUSE-SU-2019:2291-1SUSE-SU-2019:2371-1USN-3706-1USN-5336-1USN-5497-1USN-5497-2CGA-6VQR-FV5Q-4HQ3CGA-98V4-MHM4-W6RXCGA-CMW3-GVPH-FWFCCGA-GJV3-JM7X-4XCRCGA-X23M-73WW-96R8
Timeline
- 16-05-2018PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.83%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
-0.18 pp
From 5.01% on 18-09-2026
18-09-202618-10-2026
EPSS score4.83%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSecurity Advisories
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard18 products
- openjdk-10All versions (No fix recorded)
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
Redhat4 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_workstation6.0 | 7.0
- satellite5.8
Ubuntu3 products
- libjpeg-turbo< 1.3.0-0ubuntu2.1
- libjpeg6b< 6b1-4ubuntu1+esm1 | < 1:6b2-2ubuntu0.1~esm1 | All versions (No fix recorded)
- libjpeg9< 1:9b-1ubuntu1+esm1 | All versions (No fix recorded)
Debian2 products
- libjpeg-turbo< 1:1.4.2-1
- debian_linuxEOL8.0
Wolfi2 products
- openjdk-10All versions (No fix recorded)
- openjdk-9-jreAll versions (No fix recorded)
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04
Ijg1 product
- libjpeg9a
Netapp1 product
- oncommand_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.4 (No fix recorded)
Opensuse1 product
- leapEOL15.0
10 vendors · 35 products
References
29 links- access.redhat.com/errata/RHSA-2019:0474Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
lists.debian.org/debian-lts-announce/2019/01/msg00015.htmlMailing ListX Refsource MLISTThird Party AdvisoryAdvisory- access.redhat.com/errata/RHSA-2019:0469Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2019:0473Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2019:0472Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryAdvisory
- access.redhat.com/errata/RHSA-2019:0640Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
Show all 29 references
- lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.htmlVendor AdvisoryX Refsource SUSEWEB
- lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.htmlVendor AdvisoryX Refsource SUSEWEB
- www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlX Refsource CONFIRMPatchThird Party AdvisoryFIX
- github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9aX Refsource MISCExploitThird Party AdvisoryREPORTEVIDENCE
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_usX Refsource CONFIRMWEB