Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia: 2020-0014 Moderate: jhead Denial of Service Issue

mageia
Calendar Grey January 5, 2020
Dist Mageia Esm H88
Recent jhead updates for Mageia tackle various security vulnerabilities affecting JPEG images and prevent potential service interruptions.
Updated jhead package fixes security vulnerabilities: jhead 3.03 is affected by: heap-based buffer over-read

Summary

Updated jhead package fixes security vulnerabilities:
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file (CVE-2019-19035).
A vulnerability was found in jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file (CVE-2019-1010301).
A vulnerability was found in jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file (CVE-2019-1010302).

References

- https://bugs.mageia.org/show_bug.cgi?id=25938

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GPNV43VBUCMUBRBKPJBY4DDSYLHQ2GFR/

- https://www.cve.org/CVERecord?id=CVE-2019-19035

- https://www.cve.org/CVERecord?id=CVE-2019-1010301

- https://www.cve.org/CVERecord?id=CVE-2019-1010302

Topics%20covered

Topics Covered

security advisory security update heap overflow Denial of service buffer over-read jhead Mageia

Resolution

SRPMS

- 7/core/jhead-3.04-1.mga7

Publication date: 05 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0014.html
Type: security
CVE: CVE-2019-19035, CVE-2019-1010301, CVE-2019-1010302

Topics%20covered

Topics Covered

security advisory security update heap overflow Denial of service buffer over-read jhead Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here