MGASA-2018-0457

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2018-0457.html
Import Source
https://advisories.mageia.org/MGASA-2018-0457.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2018-0457
Related
Published
2018-11-17T22:23:26Z
Modified
2018-11-17T21:58:27Z
Summary
Updated jhead package fixes security vulnerabilities
Details

The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAGGPSALT handling (CVE-2018-16554).

The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length (CVE-2018-17088).

References
Credits

Affected packages

Mageia:6 / jhead

Package

Name
jhead
Purl
pkg:rpm/mageia/jhead?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.00-3.3.mga6

Ecosystem specific 

{
    "section": "core"
}