Summary
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04
LTS. (CVE-2021-28277)
Kyle Brown discovered that Jhead did not properly handle certain crafted
images when editing their comments. An attacker could possibly use this to
crash Jhead, resulting in a denial of service. (LP: #2020068)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | jhead | 1:2.97-1+deb8u2ubuntu0.1~esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | jhead | 1:3.00-4+deb9u1ubuntu0.1~esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | jhead | 1:3.00-8~ubuntu0.2+esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | jhead | 1:3.04-1ubuntu0.2+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | jhead | 1:3.06.0.1-2ubuntu0.22.04.1+esm1 |
Vulnerabilities 3
-
Unscored —
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in ex…
-
Unscored —
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveU…
-
Unscored —
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.