# CVE-2017-15232: libjpeg-turbo8: libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.

CVE-2017-15232 is fixed in 4 products on 1 platform, first by libjpeg-turbo-progs 1.5.2-0ubuntu5.18.04.1, released June 17, 2018. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2017-15232
- Priority: Routine
- CVSS: n/a (Low)
- EPSS: 0.0237
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 9, 2017

## Description

libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libjpeg-turbo-progs Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.1 | [libjpeg-turbo-progs 1.5.2-0ubuntu5.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjpeg-turbo-progs-1.5.2-0ubuntu5.18.04.1.md) | Jun 17, 2018 |
| Linux | libjpeg-turbo-test Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.1 | [libjpeg-turbo-test 1.5.2-0ubuntu5.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjpeg-turbo-test-1.5.2-0ubuntu5.18.04.1.md) | Jun 17, 2018 |
| Linux | libjpeg-turbo8 Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.1 | [libjpeg-turbo8 1.5.2-0ubuntu5.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjpeg-turbo8-1.5.2-0ubuntu5.18.04.1.md) | Jun 17, 2018 |
| Linux | libturbojpeg Ubuntu 18.04.6 LTS (bionic) | 1.5.2-0ubuntu5.18.04.1 | [libturbojpeg 1.5.2-0ubuntu5.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libturbojpeg-1.5.2-0ubuntu5.18.04.1.md) | Jun 17, 2018 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo