--- id: CVE-2018-11212 title: An issue was discovered in libjpeg 9a and 9d summary: >- An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file. severity: medium cvss: 6.5 cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H' cwe: - CWE-369 vendor: ijg product: libjpeg affected: - libjpeg = 9a - debian_linux = 8.0 - ubuntu_linux = 12.04 - ubuntu_linux = 14.04 - ubuntu_linux = 16.04 - ubuntu_linux = 18.04 - oncommand_unified_manager - oncommand_unified_manager >= 7.3 - oncommand_unified_manager >= 9.4 - oncommand_workflow_automation - snapmanager - jdk = 1.7.0 - jdk = 1.8.0 - jdk = 11.0.1 - jre = 8.0 - satellite = 5.8 - enterprise_linux_desktop = 6.0 - enterprise_linux_desktop = 7.0 - enterprise_linux_server = 6.0 - enterprise_linux_server = 7.0 - enterprise_linux_workstation = 6.0 - enterprise_linux_workstation = 7.0 - leap = 15.0 published: '2018-05-16' updated: '2026-10-15' sourceUpdated: '2026-10-15T18:17:07.450' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-11212' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html' label: cve@mitre.org - url: 'http://www.ijg.org/' label: cve@mitre.org - url: 'http://www.securityfocus.com/bid/106583' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0469' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0472' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0473' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0474' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:0640' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:1238' label: cve@mitre.org - url: 'https://access.redhat.com/errata/RHSA-2019:2052' label: cve@mitre.org - url: 'https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a' label: cve@mitre.org - url: 'https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git' label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20190118-0001/' label: cve@mitre.org - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us label: cve@mitre.org - url: 'https://usn.ubuntu.com/3706-1/' label: cve@mitre.org - url: 'https://usn.ubuntu.com/3706-2/' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00028.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.ijg.org/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.securityfocus.com/bid/106583' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0469' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0472' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0473' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0474' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:0640' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:1238' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2019:2052' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/ChijinZ/security_advisories/tree/master/libjpeg-v9a' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/zzyyrr/divide-by-zero-in-libjpeg-9d.git' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2019/01/msg00015.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20190118-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03958en_us label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/3706-1/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://usn.ubuntu.com/3706-2/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - cve.org ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-10-15T17:20:41.581855Z' epss: 0.04832 epssPercentile: 0.91885 ingestedAt: '2026-10-15T18:23:58.394Z' --- ## Overview An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted file. ## Affected - `libjpeg = 9a` - `debian_linux = 8.0` - `ubuntu_linux = 12.04` - `ubuntu_linux = 14.04` - `ubuntu_linux = 16.04` - `ubuntu_linux = 18.04` - `oncommand_unified_manager` - `oncommand_unified_manager >= 7.3` - `oncommand_unified_manager >= 9.4` - `oncommand_workflow_automation` - `snapmanager` - `jdk = 1.7.0` - `jdk = 1.8.0` - `jdk = 11.0.1` - `jre = 8.0` - `satellite = 5.8` - `enterprise_linux_desktop = 6.0` - `enterprise_linux_desktop = 7.0` - `enterprise_linux_server = 6.0` - `enterprise_linux_server = 7.0` - `enterprise_linux_workstation = 6.0` - `enterprise_linux_workstation = 7.0` - `leap = 15.0` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges.