CVE-2008-4641 — Improper Input Validation in Jhead

CWE-20 — Improper Input Validation6 documents6 sources
Severity
10.0CRITICALNVD
EPSS
2.0%
top 16.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Jhead Project JheadDebian JheadSentex Jhead
Timeline
PublishedOct 21
Latest updateMay 17

Description

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages3 packages

▶debiandebian/jhead< jhead 2.84-2 (bookworm)
▶Debianjhead_project/jhead< 2.84-2+3
▶NVDsentex/jhead2.82+19

🔴Vulnerability Details

2
GHSA
GHSA-wx67-2xhp-3w8f: The DoCommand function in jhead↗2022-05-17
▶
OSV
CVE-2008-4641: The DoCommand function in jhead↗2008-10-21
▶

📋Vendor Advisories

2
Red Hat
jhead: command exection caused by incorrect handling of the shell escapes↗2008-10-15
▶
Debian
CVE-2008-4641: jhead - The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allo...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-4641 jhead: command exection caused by incorrect handling of the shell escapes↗2008-10-22
▶