Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 502
Alerts This Week
Warning Icon 1 502

Ubuntu 20.04 LTS USN-6098-1 Critical: Jhead Crash Risks

ubuntu
Calendar Grey May 23, 2023
Dist Ubuntu Esm H88
Several Jhead vulnerabilities identified for Ubuntu versions 14.04 through 20.04 LTS may lead to system instability stemming from manipulated image files.
Several security issues were fixed in Jhead.

Summary

Several security issues were fixed in Jhead.

Software Description:

- jhead: Manipulate the non-image part of Exif compliant JPEG files

Details:

It was discovered that Jhead did not properly handle certain crafted images

while processing the JFIF markers. An attacker could cause Jhead to crash. This

issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

(CVE-2019-19035)

It was discovered that Jhead did not properly handle certain crafted images

while processing longitude tags. An attacker could cause Jhead to crash. This

issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010301)

It was discovered that Jhead did not properly handle certain crafted images

while processing IPTC data. An attacker could cause Jhead to crash. This

issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010302)

Binbin Li discovered that Jhead did not properly handle certain crafted images

while processing the DQT data. An a...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical update instructions ubuntu crash jhead crafted images

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
   jhead                           1:3.04-1ubuntu0.1

Ubuntu 18.04 LTS:
   jhead                           1:3.00-8~ubuntu0.1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   jhead                           1:3.00-4+deb9u1ubuntu0.1~esm1

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   jhead                           1:2.97-1+deb8u2ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6098-1

CVE-2019-1010301, CVE-2019-1010302, CVE-2019-19035, CVE-2020-26208,

CVE-2020-6624, CVE-2020-6625, CVE-2021-28276, CVE-2021-28278

Severity
critical
Lowest
Low
Medium
High
Critical

May 23, 2023

Topics%20covered

Topics Covered

security advisory critical update instructions ubuntu crash jhead crafted images

Package Information

https://launchpad.net/ubuntu/+source/jhead/1:3.04-1ubuntu0.1
https://launchpad.net/ubuntu/+source/jhead/1:3.00-8~ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.