PT-2018-17670 · Jhead+3 · Jhead+3

Joonun Jang · Published 2018-02-04 · Updated 2024-06-15 · CVE-2018-6612

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jhead version 3.00

Description The issue is caused by an integer underflow bug in the process EXIF function of the exif.c file, which leads to a heap-based buffer over-read when processing a malicious JPEG file. This may allow a remote attacker to cause a denial-of-service attack or have unspecified other impact.

Recommendations For jhead version 3.00, as a temporary workaround, consider disabling the process EXIF function until a patch is available. Restrict access to the exif.c file to minimize the risk of exploitation. Avoid using jhead to process untrusted JPEG files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Underflow

Out of bounds Read

Weakness Enumeration

CWE-191

CWE-125

Related Identifiers

ALT-PU-2018-2978

CVE-2018-6612

MGASA-2018-0146

OPENSUSE-SU-2021:0743-1

OPENSUSE-SU-2021:0752-1

OPENSUSE-SU-2021_0743-1

OPENSUSE-SU-2024:10880-1

USN-6113-1

Affected Products

Alt Linux

Suse

Ubuntu

Jhead

References · 34

• https://osv.dev/vulnerability/DEBIAN-CVE-2018-6612 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-6612 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-6612 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-6612 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6113-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0743-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-6612 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6612 · Security Note
• https://advisories.mageia.org/MGASA-2018-0146.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10880-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0752-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-6612 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6113-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-3822 · Note