Debian Security Advisory 1038-1: Andrea Barisani discovered that xzgv, a picture viewer for X with a thumbnail-based selector, attempts to decode JPEG images within the CMYK/YCCK colour space incorrectly, which could lead to the execution of arbitrary code.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/45690/dsa-1038-1.txt
Source: https://packetstormsecurity.com/files/45690/Debian-Linux-Security-Advisory-1038-1.html