CVE-2016-3822 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Jhead

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-190 — Integer Overflow or Wraparound10 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 42.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Jhead Project JheadDebian JheadDebian Linux+1 more
Timeline
PublishedAug 5
Latest updateMay 14

Description

exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data, aka internal bug 28868315.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/jhead< jhead 1:3.00-8 (bookworm)+1
▶Debianjhead_project/jhead< 1:3.00-4+7
▶NVDgoogle/android22 versions+21

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: android.googlesource.com ↗Patch: android.googlesource.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-vq3j-5p4r-99x3: exif↗2022-05-14
▶
GHSA
GHSA-727r-rxp4-hwwc: The ProcessGpsInfo function of the gpsinfo↗2022-05-13
▶
OSV
CVE-2018-17088: The ProcessGpsInfo function of the gpsinfo↗2018-09-16
▶
OSV
CVE-2016-3822: exif↗2016-08-05
▶

📋Vendor Advisories

3
Debian
CVE-2018-17088: jhead - The ProcessGpsInfo function of the gpsinfo.c file of jhead 3.00 may allow a remo...↗2018
▶
Android
CVE-2016-3822: Android Security Bulletin 2016-08-01 CVE: CVE-2016-3822 Severity: HIGH Affected AOSP versions: 4↗2016-08-01
▶
Debian
CVE-2016-3822: jhead - exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before ...↗2016
▶

💬Community

1
Bugzilla
CVE-2018-17088 jhead: Integer overflow in gpsinfo.c while running jhead↗2018-09-17
▶