Mageia alert MGASA-2018-0457 (jhead)

From:
             
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
             
 
updates-announce@ml.mageia.org 
Subject:
             
 
[updates-announce] MGASA-2018-0457: Updated jhead package fixes security vulnerabilities 
Date:
             
 
Sat, 17 Nov 2018 23:24:18 +0100
Message-ID:
             
 
<20181117222418.793D29FEE1@duvel.mageia.org>
MGASA-2018-0457 - Updated jhead package fixes security vulnerabilities

Publication date: 17 Nov 2018
URL: https://advisories.mageia.org/MGASA-2018-0457.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2018-16554,
     CVE-2018-17088

Description:
The ProcessGpsInfo function may have allowed a remote attacker to cause
a denial-of-service attack or unspecified other impact via a malicious
JPEG file, because of inconsistency between float and double in a
sprintf format string during TAG_GPS_ALT handling (CVE-2018-16554).

The ProcessGpsInfo function may have allowed a remote attacker to cause
a denial-of-service attack or unspecified other impact via a malicious
JPEG file, because there is an integer overflow during a check for
whether a location exceeds the EXIF data length (CVE-2018-17088).

References:
- https://bugs.mageia.org/show_bug.cgi?id=23676
- https://lists.opensuse.org/opensuse-updates/2018-09/msg00...
- https://lists.opensuse.org/opensuse-updates/2018-10/msg00...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1...

SRPMS:
- 6/core/jhead-3.00-3.3.mga6