[ubuntu/bionic-updates] jhead 1:3.00-8~ubuntu0.1 (Accepted)

[Ubuntu Archive Robot]

jhead (1:3.00-8~ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: heap out-of-bounds read when processing the JFIF markers
    - debian/patches/CVE-2019-19035.patch: Adds verifications in jpgfile.c. The
      number of sections should be greater than 7. The JFIF header should exist
      before verifying its magic bytes.
    - CVE-2019-19035
  * SECURITY UPDATE: stack buffer overflow when processing longitude tags
    - debian/patches/CVE-2019-1010301.patch: Replaces a call to sprintf with
      one to snprinf in gpsinfo.c.
    - CVE-2019-1010301
  * SECURITY UPDATE: heap buffer overflow when processing IPTC data
    - debian/patches/CVE-2019-1010302.patch: Ensures the length of IPTC data is
      strictly positive in iptc.c.
    - CVE-2019-1010302
  * SECURITY UPDATE: heap buffer overflow when processing the DQT markers
    - debian/patches/CVE-2020-6624.patch: Adds further DQT verifications in
      jpgqguess.c.
    - CVE-2020-6624
  * SECURITY UPDATE: heap out-of-bounds read when processing longitude tags
    - debian/patches/CVE-2020-6625.patch: Adds further verifications in
      gpsinfo.c.
    - CVE-2020-6625
  * SECURITY UPDATE: heap buffer overflow when reading JPEG sections
    - debian/patches/CVE-2020-26208.patch: Allocates additional 20 bytes in
      jpgfile.c.
    - CVE-2020-26208
  * SECURITY UPDATE: heap out-of-bounds read when processing Canon images
    - debian/patches/CVE-2021-28276_28278.patch: Adds further verifications in
      makernote.c.
    - CVE-2021-28276
  * SECURITY UPDATE: heap buffer overflow when removing a certain type of
    section
    - debian/patches/CVE-2021-28276_28278.patch: Adds further verifications
      while processing nested EXIF directories in exif.c.
    - CVE-2021-28278

Date: 2023-05-18 08:42:11.157605+00:00
Changed-By: George-Andrei Iosif <andrei.iosif at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/jhead/1:3.00-8~ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.