MGASA-2020-0014 - Updated jhead packages fix security vulnerabilities

Publication date: 05 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0014.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-19035,
     CVE-2019-1010301,
     CVE-2019-1010302

Updated jhead package fixes security vulnerabilities:

jhead 3.03 is affected by: heap-based buffer over-read. The impact is:
Denial of service. The component is: ReadJpegSections and process_SOFn
in jpgfile.c. The attack vector is: Open a specially crafted JPEG file
(CVE-2019-19035).

A vulnerability was found in jhead 3.03 is affected by: Buffer Overflow.
The impact is: Denial of service. The component is: gpsinfo.c Line 151
ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG
file (CVE-2019-1010301).

A vulnerability was found in jhead 3.03 is affected by: Incorrect Access
Control. The impact is: Denial of service. The component is: iptc.c Line
122 show_IPTC(). The attack vector is: the victim must open a specially
crafted JPEG file (CVE-2019-1010302).

References:
- https://bugs.mageia.org/show_bug.cgi?id=25938
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GPNV43VBUCMUBRBKPJBY4DDSYLHQ2GFR/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19035
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010301
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010302

SRPMS:
- 7/core/jhead-3.04-1.mga7