File _patchinfo of Package patchinfo.9036

<patchinfo incident="9036">
  <issue tracker="bnc" id="1108672">VUL-0: CVE-2018-17088: jhead: Integer overflow in gpsinfo.c while running jhead</issue>
  <issue tracker="bnc" id="1108480">VUL-1: CVE-2018-16554: jhead: Interger overflow while running jhead</issue>
  <issue tracker="cve" id="2018-17088"/>
  <issue tracker="cve" id="2018-16554"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>mcalabkova</packager>
  <description>This update for jhead fixes the following issues:

Security issues fixed:

- CVE-2018-17088: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow during a check for whether a location exceeds the EXIF data length. This is analogous to the CVE-2016-3822 integer overflow in exif.c.  (boo#1108672)
- CVE-2018-16554: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because of inconsistency between float and double in a sprintf format string during TAG_GPS_ALT handling. (boo#1108480) 

</description>
  <summary>Security update for jhead</summary>
</patchinfo>