MGASA-2018-0457

Dashboard / Vulnerabilities / MGASA-2018-0457

MGASA-2018-0457

Summary: Updated jhead package fixes security vulnerabilities

Details: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling (CVE-2018-16554). The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length (CVE-2018-17088).

References: https://advisories.mageia.org/MGASA-2018-0457.html, https://bugs.mageia.org/show_bug.cgi?id=23676, https://lists.opensuse.org/opensuse-updates/2018-09/msg00142.html, https://lists.opensuse.org/opensuse-updates/2018-10/msg00198.html