CVE-2018-17088

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-16 · updated 2026-06-17
Weakness: CWE-190

Description

The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.

Affected products

jhead: 3.00

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925
https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925
https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html

Get alerted when CVE-2018-17088 or the next vulnerability affects your stack