econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a …

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 1

• DSA-2754-1 exactimage - denial of service Debian Security (DSA / DLA) · Mar 9, 2026

References

• http://anonscm.debian.org/gitweb/?p=collab-maint/exactimage.git%3Ba=commitdiff%3Bh=1dff2eb586a3d10d8528a984bc471292e3789f5c%3Bhp=acfe54193b18b46e880f4b474d2e40b4fdb44a8d
• DSA-2754 vendor-advisory
• [oss-security] 20130805 [notification] exactimage DoS, jumping into the unknown mailing-list