The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2052 advisory.

    - Fix CVE-2018-14498 (#1687475)
    - Fix CVE-2018-11212 (#1586062)
    - Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091)       and CVE-2018-11214 (#1589110)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been resolved in libjpeg-turbo, Debian's default JPEG implemenation.

CVE-2016-3616

The cjpeg utility in libjpeg allowed remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.

This issue got fixed by the same patch that fixed CVE-2018-11213 and CVE-2018-11214.

CVE-2018-1152

libjpeg-turbo has been found vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image. The issue has been resolved by a boundary check.

CVE-2018-11212

The alloc_sarray function in jmemmgr.c allowed remote attackers to cause a denial of service (divide-by-zero error) via a crafted file.

The issue has been addressed by checking the image size when reading a targa file and throwing an error when image width or height is 0.

CVE-2018-11213 CVE-2018-11214

The get_text_gray_row and get_text_rgb_row functions in rdppm.c both allowed remote attackers to cause a denial of service (Segmentation fault) via a crafted file.

By checking the range of integer values in PPM text files and adding checks to ensure values are within the specified range, both issues

For Debian 8 'Jessie', these problems have been fixed in version 1:1.3.1-12+deb8u1.

We recommend that you upgrade your libjpeg-turbo packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer     dereference and application crash) or execute arbitrary code via a crafted file. (CVE-2016-3616)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libjpeg-turbo packages installed that are affected by multiple vulnerabilities:

  - The cjpeg utility in libjpeg allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) or execute arbitrary code via a     crafted file. (CVE-2016-3616)

  - libjpeg 9c has a large loop because read_pixel in     rdtarga.c mishandles EOF. (CVE-2018-11813)

  - An issue was discovered in libjpeg 9a. The     get_text_gray_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11213)

  - An issue was discovered in libjpeg 9a. The     get_text_rgb_row function in rdppm.c allows remote     attackers to cause a denial of service (Segmentation     fault) via a crafted file. (CVE-2018-11214)

  - An issue was discovered in libjpeg 9a. The alloc_sarray     function in jmemmgr.c allows remote attackers to cause a     denial of service (divide-by-zero error) via a crafted     file. (CVE-2018-11212)

  - get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90     and MozJPEG through 3.3.1 allows attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted 8-bit BMP in which one     or more of the color indices is out of range for the     number of palette entries. (CVE-2018-14498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.11.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.2 advisory.

  - Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow     can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels,     assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass     invalid utf-8 strings to functions like pango_itemize. (CVE-2019-1010238)

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

  - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can     send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed     later on, leading to DoS (segmentation fault). (CVE-2018-14598)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable     to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other     impact. (CVE-2018-14599)

  - An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a     variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading     to DoS or remote code execution. (CVE-2018-14600)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990665 advisory.

    The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer     dereference and application crash) or execute arbitrary code via a crafted file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

已解決 Debian 的預設 JPEG 實作 libjpeg-turbo 中的數個弱點。CVE-2016-3616 libjpeg 中的 cjpeg 公用程式可讓遠端攻擊者透過特製檔案，導致拒絕服務 (NULL 指標解除參照和應用程式損毀) 或執行任意程式碼。此問題已由修正 CVE-2018-11213 和 CVE-2018-11214 的修補程式所修正。CVE-2018-1152 據發現，libjpeg-turbo 在處理特製的 BMP 影像時，容易發生由除以零造成的拒絕服務弱點。此問題已由邊界檢查所解決。CVE-2018-11212 jmemmgr.c 中的 alloc_sarray 函式可讓遠端攻擊者透過特製的檔案導致拒絕服務 (除以零錯誤)。透過在讀取目標檔案時檢查影像大小，並在影像寬度或高度為 0 時擲出一個錯誤，此問題得以解決。CVE-2018-11213 CVE-2018-11214 rdppm.c 中的 get_text_gray_row 和 get_text_rgb_row 函式均可讓遠端攻擊者透過特製的檔案導致拒絕服務 (分割錯誤)。通過檢查 PPM 文字檔案中整數值的範圍並新增檢查以確定值在指定範圍內。針對 Debian 8「Jessie」，這些問題已在 1:1.3.1-12+deb8u1 版本中修正。建議您升級 libjpeg-turbo 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端 Oracle Linux 7 主機中安裝的套件受到 ELSA-2019-2052 公告中提及的多個弱點影響。

  - libjpeg 中的 cjpeg 公用程式允許遠端攻擊者透過特製的檔案，導致拒絕服務 (NULL 指標解除參照和應用程式損毀) 或執行任意程式碼。(CVE-2016-3616)

  - 在 libjpeg 9a 中發現一個問題。rdppm.c 中的 get_text_rgb_row 函式允許遠端攻擊者透過特製的檔案造成拒絕服務 (分割錯誤)。(CVE-2018-11214)

  - 在 libjpeg 9a 和 9d 中發現一個問題。jmemmgr.c 的 alloc_sarray 函式讓遠端攻擊者得以透過特製的檔案，造成拒絕服務 (除以零錯誤)。(CVE-2018-11212)

  - 在 libjpeg 9a 中發現一個問題。rdppm.c 中的 get_text_gray_row 函式允許遠端攻擊者透過特製的檔案造成拒絕服務 (分割錯誤)。(CVE-2018-11213)

  - 由於 rdtrga.c 中的 read_pixel 不當處理 EOF，導致 libjpeg 9c 產生大型迴圈。(CVE-2018-11813)

  - 在 1.5.90 以及更早的 libjpeg-turbo 和 3.3.1 以及更早的 MozJPEG 中，rdbmp.c 的 get_8bit_row 讓攻擊者可以透過特製的 8 位元 BMP (其中一或多個顏色指數超出調色盤項目的數量範圍) 造成程式拒絕服務 (堆積型緩衝區過度讀取和應用程式損毀)。(CVE-2018-14498)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

執行 CORE 5.04 / MAIN 5.04 版的遠端 NewStart CGSL 主機安裝了受多個弱點影響的 libjpeg-turbo 套件：- libjpeg 中的 cjpeg 公用程式讓遠端攻擊者得以透過特製的檔案造成拒絕服務 (NULL 指標解除參照和應用程式損毀) 或執行任意程式碼。(CVE-2016-3616) - 由於 rdtarga.c 中的 read_pixel 不當處理 EOF，使 libjpeg 9c 產生大型迴圈。(CVE-2018-11813) - 在 libjpeg 9a 中發現一個問題。rdppm.c 的 get_text_gray_row 函式讓遠端攻擊者得以透過特製的檔案，造成拒絕服務 (分割錯誤)。(CVE-2018-11213) - 在 libjpeg 9a 中發現一個問題。rdppm.c 的 get_text_rgb_row 函式讓遠端攻擊者得以透過特製的檔案，造成拒絕服務 (分割錯誤)。(CVE-2018-11214) - 在 libjpeg 9a 中發現一個問題。jmemmgr.c 的 alloc_sarray 函式讓遠端攻擊者得以透過特製的檔案，造成拒絕服務 (除以零錯誤)。(CVE-2018-11212) - 在 1.5.90 之前的 libjpeg-turbo 和 3.3.1 之前的 MozJPEG 中，rdbmp.c 的 get_8bit_row 讓攻擊者得以透過特製的 8 位元 BMP (其中一或多個顏色指數超出調色盤項目的數量範圍) 造成拒絕服務 (堆積型緩衝區過度讀取和應用程式損毀)。(CVE-2018-14498) 請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - libjpeg 中的 cjpeg 公用程式允許遠端攻擊者透過特製的檔案，導致拒絕服務 (NULL 指標解除參照和應用程式損毀) 或執行任意程式碼。(CVE-2016-3616)

請注意，Nessus 依賴供應商報告的套件存在。

遠端主機上安裝的 AOS 版本低於 5.11.2。因此，它受到 NXSA-AOS-5.11.2 公告中所提及的多個弱點影響。

  - Gnome Pango 1.42 及更高版本受到下列弱點影響：緩衝區溢位。影響為：堆積型緩衝區溢位可用來執行程式碼。元件為：函式名稱：pango_log2vis_get_embedding_levels，nchars 和迴圈條件的指派。攻擊媒介為：當應用程式將無效的 utf-8 字串傳送至 pango_itemize 之類的函式時，錯誤可能會遭到利用。(CVE-2019-1010238)

  - curl 7.61.1 之前版本容易受到 NTLM 驗證碼中的緩衝區溢位弱點影響。內部函式 Curl_ntlm_core_mk_nt_hash 會將密碼長度乘以二 (SUM) 以算出從堆積配置的暫存儲存區域大小。接著，長度值之後會用來逐一查看密碼，並在配置的儲存緩衝區中產生輸出。在具有 32 位元 size_t 的系統上，當密碼長度超過 2GB (2^31 個位元組) 時，計算 SUM 的數學會觸發整數溢位。此整數溢位通常會造成實際配置非常小的緩衝區，而不是預期非常大的緩衝區，進而利用該緩衝區結束堆積緩衝區溢位。(此錯誤與 CVE-2017-8816 基本相同。)(CVE-2018-14618)

  - 在 libX11 1.6.5 和之前的所有版本中，發現 ListExt.c 的 XListExtensions 中存在問題。惡意伺服器可傳送第一個字串會發生溢位的回覆，導致之後釋放設定為 NULL 的變數，進而造成拒絕服務 (分割錯誤)。(CVE-2018-14598)

  - 在 libX11 1.6.5 和之前所有版本中發現一個問題。ListExt.c 中的 XListExtensions 函式容易因惡意伺服器端回應而發生差一錯誤，從而造成 DoS 或可能導致其他不明影響。(CVE-2018-14599)

  - 在 libX11 1.6.5 和之前所有版本中發現一個問題。ListExt.c 中的 XListExtensions 函式會將變數解譯為已簽署，而不是未簽署，從而導致超出邊界寫入 (最多 128 個位元組)，進而造成拒絕服務或可能觸發遠端程式碼執行。(CVE-2018-14600)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
180767	Oracle Linux 7 : libjpeg-turbo (ELSA-2019-2052)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
121315	Debian DLA-1638-1 : libjpeg-turbo security update	Nessus	Debian Local Security Checks	2019/1/23	2024/6/26	high
219667	Linux Distros Unpatched Vulnerability : CVE-2016-3616	Nessus	Misc.	2025/3/4	2025/9/3	high
129912	NewStart CGSL CORE 5.04 / MAIN 5.04 : libjpeg-turbo Multiple Vulnerabilities (NS-SA-2019-0185)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2024/4/18	high
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical
274579	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libjpeg-turbo (UTSA-2025-990665)	Nessus	Unity Linux Local Security Checks	2025/11/10	2025/11/10	high
121315	Debian DLA-1638-1：libjpeg-turbo 安全性更新	Nessus	Debian Local Security Checks	2019/1/23	2024/6/26	high
180767	Oracle Linux 7：libjpeg-turbo (ELSA-2019-2052)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
129912	NewStart CGSL CORE 5.04 / MAIN 5.04：libjpeg-turbo 多個弱點 (NS-SA-2019-0185)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2024/4/18	high
219667	Linux Distros 未修補弱點：CVE-2016-3616	Nessus	Misc.	2025/3/4	2025/9/3	high
164608	Nutanix AOS：多個弱點 (NXSA-AOS-5.11.2)	Nessus	Misc.	2022/9/1	2025/7/22	critical

検出

プラグインの検索

high

high

high

high

critical

high

high

high

high

high

critical