CVE-2018-17088: Integer Overflow
First published: Tue Sep 04 2018(Updated: )
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jhead Project Jhead | =3.00 | |
| debian/jhead | 1:3.04-6+deb11u1 1:3.06.0.1-6 1:3.08-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2016-3822
- https://sources.debian.org/src/jhead/1:3.00-7/debian/patches/31_CVE-2016-3822/
- https://cveform.mitre.org/
- https://security-tracker.debian.org/tracker/CVE-2018-16554
- https://security-tracker.debian.org/tracker/CVE-2018-17088
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925
- https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html
Frequently Asked Questions
What is the severity of CVE-2018-17088?
The severity of CVE-2018-17088 is high.
How does CVE-2018-17088 impact jhead 3.00?
CVE-2018-17088 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file.
How can I fix CVE-2018-17088?
There is currently no known fix for CVE-2018-17088. It is recommended to update to the latest version of jhead if available or consider using an alternative software.
What is the Common Vulnerabilities and Exposures (CVE) ID of this vulnerability?
The Common Vulnerabilities and Exposures (CVE) ID of this vulnerability is CVE-2018-17088.
What is the Common Weakness Enumeration (CWE) ID of this vulnerability?
The Common Weakness Enumeration (CWE) ID of this vulnerability is CWE-190.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/debian-bugs
- alias/CVE-2018-17088
- agent/tags
- agent/trending
- vendor/jhead project
- canonical/jhead project jhead
- version/jhead project jhead/3.00
- package-manager/debian