CVE-2018-16554
jhead: The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-serv...
CVE-2018-16554 is fixed in jhead on 1 platform by jhead 1:3.00-8~build0.18.04.1 (version 1:3.00-8~build0.18.04.1), released September 16, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0177
78th percentile
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| jhead · Ubuntu 18.04.6 LTS (bionic) | 1:3.00-8~build0.18.04.1 | jhead 1:3.00-8~build0.18.04.1 | Sep 16, 2018 |