CVE-2017-9614
HighSummary
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file.
Risk Assessment
Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to service downtime and loss of system availability.
Recommendation
It is recommended to update libjpeg-turbo to the latest version to mitigate this vulnerability and to monitor applications for unauthorized access.
Other vulnerabilities in libjpeg-turbo 1.5.1
See all- CVE-2026-75466Medium
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.
- CVE-2020-35538Medium
A vulnerability in libjpeg-turbo causes a null pointer dereference in jcopy_sample_rows() when processing a crafted input file. This can lead to a crash of the application using the library.
Original NVD description (English source)
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API
Vulnerability data from NVD (NIST) · CISA KEV · EPSS