jhead: The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-serv...
CVE-2018-17088 is fixed in jhead on 1 platform by jhead 1:3.00-8~build0.18.04.1 (version 1:3.00-8~build0.18.04.1), released September 16, 2018. It is not reported as exploited. Patch Radar priority: Routine.
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| jhead · Ubuntu 18.04.6 LTS (bionic) | 1:3.00-8~build0.18.04.1 | jhead 1:3.00-8~build0.18.04.1 | Sep 16, 2018 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.