CVE-2018-6612: Integer Underflow
An integer underflow bug in the processEXIF function of the exif.c file of jhead 3.00 raises a heap-based buffer over-read when processing a malicious JPEG file, which may allow a remote attacker to cause a denial-of-service attack or unspecified other impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jheadto a version that resolves this vulnerability.Fixed in 1:3.04-6+deb11u1Fixed in 1:3.06.0.1-6Fixed in 1:3.08-2
Event History
Frequently Asked Questions
What is CVE-2018-6612?
CVE-2018-6612 is an integer underflow bug in the process_EXIF function of the exif.c file of jhead 3.00.
What is the severity of CVE-2018-6612?
The severity of CVE-2018-6612 is high with a CVSS score of 5.5.
How does CVE-2018-6612 affect jhead?
CVE-2018-6612 raises a heap-based buffer over-read when processing a malicious JPEG file in jhead, which may allow a remote attacker to cause a denial-of-service attack or unspecified other impact.
Which software versions are affected by CVE-2018-6612?
jhead versions 3.00, 3.04, 3.06.0.1, and 3.08 are affected by CVE-2018-6612.
How can I fix CVE-2018-6612?
Update to jhead version 3.00-8, 3.04-6+deb11u1, 3.06.0.1-6, or 3.08-2 to fix CVE-2018-6612.