CVE-2018-14498: debian debian_linux Out-of-bounds Read
Vulnerability summary
CVE-2018-14498 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in debian debian_linux. EPSS estimates a 3.09% chance of exploitation in the next 30 days, higher than 87.5% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 7 · Related 5Timeline
- 07-03-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated4.4MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.09%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.09% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundLibjpeg Turbo
Maturity: poc
Mozjpeg
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat9 products
- libjpeg-turbo< 0:1.5.3-10.el8
- libjpeg-turbo-debuginfo< 0:1.5.3-10.el8
- libjpeg-turbo-debugsource< 0:1.5.3-10.el8
- libjpeg-turbo-devel< 0:1.5.3-10.el8
- libjpeg-turbo-utils< 0:1.5.3-10.el8
Debian2 products
- libjpeg-turbo< 1:2.0.5-1 | < 1:1.3.1-12+deb8u2
- debian_linuxEOL8.0
Alpine1 product
- libjpeg-turbo< 1.5.3-r3 | < 1.5.3-r5
Fedoraproject1 product
- fedoraEOL28
Libjpeg-turbo1 product
- libjpeg-turbo≤ 1.5.90
Mageia1 product
- libjpeg< 1.5.1-1.3.mga6
Mozilla1 product
- mozjpeg≤ 3.3.1
Opensuse1 product
- leapEOL15.0
Ubuntu1 product
- libjpeg-turbo< 1.3.0-0ubuntu2.1+esm2 | < 1.4.2-0ubuntu3.3 | < 1.5.2-0ubuntu5.18.04.3
9 vendors · 18 products
References
28 links- github.com/libjpeg-turbo/libjpeg-turbo/commit/9c78a04df4e44ef6487eee99c4258397f4fdca55X Refsource MISCPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2019/03/msg00021.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2019-04/msg00015.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
