CVE-2008-4641
published 2008-10-21CVE-2008-4641: The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in…
PriorityP344critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
2.20%
80.5th percentile
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jhead | < jhead 2.84-2 (bookworm) | jhead 2.84-2 (bookworm) |
| jhead_project | jhead | >= 0 < 2.84-2 | 2.84-2 |
| jhead_project | jhead | >= 0 < 2.84-2 | 2.84-2 |
| jhead_project | jhead | >= 0 < 2.84-2 | 2.84-2 |
| jhead_project | jhead | >= 0 < 2.84-2 | 2.84-2 |
| sentex | jhead | <= 2.82 | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
| sentex | jhead | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0LOW
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jhead: command exection caused by incorrect handling of the shell escapes
vendor_redhat·2008-10-15·CVSS 10.0
CVE-2008-4641 [CRITICAL] jhead: command exection caused by incorrect handling of the shell escapes
jhead: command exection caused by incorrect handling of the shell escapes
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
Debian
CVE-2008-4641: jhead - The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allo...
vendor_debian·2008·CVSS 10.0
CVE-2008-4641 [CRITICAL] CVE-2008-4641: jhead - The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allo...
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
Scope: local
bookworm: resolved (fixed in 2.84-2)
bullseye: resolved (fixed in 2.84-2)
forky: resolved (fixed in 2.84-2)
sid: resolved (fixed in 2.84-2)
trixie: resolved (fixed in 2.84-2)
GHSA
GHSA-wx67-2xhp-3w8f: The DoCommand function in jhead
ghsa_unreviewed·2022-05-17
CVE-2008-4641 [HIGH] CWE-20 GHSA-wx67-2xhp-3w8f: The DoCommand function in jhead
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
OSV
CVE-2008-4641: The DoCommand function in jhead
osv·2008-10-21·CVSS 10.0
CVE-2008-4641 [CRITICAL] CVE-2008-4641: The DoCommand function in jhead
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2008/10/15/5http://www.openwall.com/lists/oss-security/2008/10/15/6http://www.openwall.com/lists/oss-security/2008/10/16/3http://www.openwall.com/lists/oss-security/2008/11/26/4http://www.securityfocus.com/bid/31921https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/271020http://www.openwall.com/lists/oss-security/2008/10/15/5http://www.openwall.com/lists/oss-security/2008/10/15/6http://www.openwall.com/lists/oss-security/2008/10/16/3http://www.openwall.com/lists/oss-security/2008/11/26/4http://www.securityfocus.com/bid/31921https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/271020
2008-10-21
Published