CVE-2018-17088
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to...
CVE-2018-17088 is a high vulnerability (CVSS 7.8) in Jhead Project Jhead, published September 16, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in jhead 1:3.00-8.
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
CVE-2018-17088- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
CVE-2018-17088- Updated
- 2026-11-02
EUVDEUVD-2018-8868 No score
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
EUVD-2018-8868- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-727r-rxp4-hwwc
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to...
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
GHSA-727r-rxp4-hwwc- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
CVE-2018-17088- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-17088
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
DEBIAN-CVE-2018-17088- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2018-17088
The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c. This gpsinfo.c vulnerability is unrelated to the CVE-2018-16554 gpsinfo.c vulnerability.
- Record
UBUNTU-CVE-2018-17088- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0457 No score
Updated jhead package fixes security vulnerabilities
The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling (CVE-2018-16554).
The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length (CVE-2018-17088).
- Record
MGASA-2018-0457- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0743-1 No score
Security update for jhead
This update for jhead fixes the following issues:
jhead was updated to 3.06.0.1
- lot of fuzztest fixes
- Apply a whole bunch of patches from Debian.
- Spell check and fuzz test stuff from Debian, nothing useful to human users.
- Add option to set exif date from date from another file.
- Bug fixes relating to fuzz testing.
- Fix bug where thumbnail replacement DID NOT WORK.
- Fix bug when no orientation tag is present
- Fix bug of not clearing exif information when processing images with an without exif data in one invocation.
- Remove some unnecessary warnings with some types of GPS data
- Remove multiple copies of the same type of section when deleting section types
- Record
openSUSE-SU-2021:0743-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0752-1 No score
Security update for jhead
This update for jhead fixes the following issues:
jhead was updated to 3.06.0.1
- lot of fuzztest fixes
- Apply a whole bunch of patches from Debian.
- Spell check and fuzz test stuff from Debian, nothing useful to human users.
- Add option to set exif date from date from another file.
- Bug fixes relating to fuzz testing.
- Fix bug where thumbnail replacement DID NOT WORK.
- Fix bug when no orientation tag is present
- Fix bug of not clearing exif information when processing images with an without exif data in one invocation.
- Remove some unnecessary warnings with some types of GPS data
- Remove multiple copies of the same type of section when deleting section types
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0752-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10880-1 No score
jhead-3.06.0.1-1.3 on GA media
These are all security issues fixed in the jhead-3.06.0.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10880-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jheadDebian:12 |
before 1:3.00-8 | 1:3.00-8 |
jheadDebian:13 |
before 1:3.00-8 | 1:3.00-8 |
jheadDebian:14 |
before 1:3.00-8 | 1:3.00-8 |
jheadDebian:8 |
before 1:2.97-1+deb8u2, plus listed versions 1:2.97-11:2.97-1+deb8u1 |
1:2.97-1+deb8u2 |
jheadMageia:6 |
before 3.00-3.3.mga6 | 3.00-3.3.mga6 |
jheadUbuntu:Pro:14.04:LTS |
before 1:2.97-1+deb8u2build0.14.04.1~esm1, plus listed versions 1:2.97-11:2.97-1+deb8u1build0.14.04.1 |
1:2.97-1+deb8u2build0.14.04.1~esm1 |
jheadUbuntu:18.04:LTS |
before 1:3.00-8~build0.18.04.1, plus listed versions 1:3.00-41:3.00-51:3.00-6 |
1:3.00-8~build0.18.04.1 |
jheadopenSUSE:Leap 15.2 |
before 3.06.0.1-lp152.7.6.1 | 3.06.0.1-lp152.7.6.1 |
jheadSUSE:Package Hub 15 SP2 |
before 3.06.0.1-bp152.4.6.1 | 3.06.0.1-bp152.4.6.1 |
jheadopenSUSE:Tumbleweed |
before 3.06.0.1-1.3 | 3.06.0.1-1.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=907925
lists.debian.org/debian-lts-announce/2019/12/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2018-17088
github.com/advisories/GHSA-727r-rxp4-hwwc
security-tracker.debian.org/tracker/CVE-2018-17088
advisories.mageia.org/MGASA-2018-0457.html
Show 20 moreShow less
bugs.mageia.org/show_bug.cgi?id=23676
lists.opensuse.org/opensuse-updates/2018-09/msg00142.html
ubuntu.com/security/CVE-2018-17088
cve.org/CVERecord?id=CVE-2018-17088
bugzilla.suse.com/1144316
suse.com/security/cve/CVE-2016-3822