Summary
It was discovered that Jhead did not properly handle certain crafted images
while rotating them. An attacker could possibly use this issue to crash Jhead,
resulting in a denial of service. (CVE-2021-34055)
Kyle Brown discovered that Jhead did not properly handle certain crafted
images while regenerating the Exif thumbnail. An attacker could possibly use
this issue to execute arbitrary commands. (CVE-2022-41751)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | jhead | 1:3.00-8~ubuntu0.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | jhead | 1:3.04-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | jhead | 1:3.06.0.1-2ubuntu0.22.04.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | jhead | 1:2.97-1+deb8u2ubuntu0.1~esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | jhead | 1:3.00-4+deb9u1ubuntu0.1~esm2 |
Vulnerabilities 2
-
High 7.8
jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u.
-
High 7.8
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the …