CVE-2019-1010301
MEDIUM EPSS 64.7%
Published Jul 15, 20196y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published Jul 15, 2019 6y ago
Last Modified Jun 17, 2026 2w ago
Description
jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
64.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-787 Out-of-bounds Write Memory Safety
Affected Products 4
| Vendor | Product | Version | Range |
|---|---|---|---|
| jhead_project | jhead | 3.03 | any |
| fedoraproject | fedora | 29 | any |
| fedoraproject | fedora | 30 | any |
| debian | debian_linux | 8.0 | any |
References 7
- bugs.launchpad.net https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1838251
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1679952
- launchpadlibrarian.net https://launchpadlibrarian.net/435112680/32_crash_in_gpsinfo
- lists.debian.org https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTGUHTJTQ6EKEPDXFSKZKVLUJC4UAPBQ/
- security.gentoo.org https://security.gentoo.org/glsa/202007-17
Remediation
- launchpadlibrarian.net https://launchpadlibrarian.net/435112680/32_crash_in_gpsinfo