CVE-2021-28275
published 2022-03-23CVE-2021-28275: A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault…
PriorityP417medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.65%
47.0th percentile
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jhead | < jhead 1:3.06.0.1-2 (bookworm) | jhead 1:3.06.0.1-2 (bookworm) |
| jhead_project | jhead | — | — |
| jhead_project | jhead | — | — |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2 | 1:3.06.0.1-2 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2 | 1:3.06.0.1-2 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2 | 1:3.06.0.1-2 |
| jhead_project | jhead | >= 0 < 1:2.97-1+deb8u2ubuntu0.1~esm3 | 1:2.97-1+deb8u2ubuntu0.1~esm3 |
| jhead_project | jhead | >= 0 < 1:3.00-4+deb9u1ubuntu0.1~esm3 | 1:3.00-4+deb9u1ubuntu0.1~esm3 |
| jhead_project | jhead | >= 0 < 1:3.00-8~ubuntu0.2+esm1 | 1:3.00-8~ubuntu0.2+esm1 |
| jhead_project | jhead | >= 0 < 1:3.04-1ubuntu0.2+esm1 | 1:3.04-1ubuntu0.2+esm1 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2ubuntu0.22.04.1+esm1 | 1:3.06.0.1-2ubuntu0.22.04.1+esm1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Jhead vulnerabilities
osv·2023-05-29·CVSS 5.5
CVE-2021-3496 [MEDIUM] Jhead vulnerabilities
Jhead vulnerabilities
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of servi
GHSA
GHSA-67w2-vvm4-fjr9: A Denial of Service vulnerability exists in jhead 3
ghsa_unreviewed·2022-03-24
CVE-2021-28275 [MEDIUM] CWE-704 GHSA-67w2-vvm4-fjr9: A Denial of Service vulnerability exists in jhead 3
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
OSV
CVE-2021-28275: A Denial of Service vulnerability exists in jhead 3
osv·2022-03-23·CVSS 5.5
CVE-2021-28275 [MEDIUM] CVE-2021-28275: A Denial of Service vulnerability exists in jhead 3
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
Ubuntu
Jhead vulnerabilities
vendor_ubuntu·2023-05-29·CVSS 5.5
CVE-2021-28277 [MEDIUM] Jhead vulnerabilities
Title: Jhead vulnerabilities
Summary: Jhead could be made to crash if it opened a specially crafted
file.
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An
Debian
CVE-2021-28275: jhead - A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild ad...
vendor_debian·2021·CVSS 5.5
CVE-2021-28275 [MEDIUM] CVE-2021-28275: jhead - A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild ad...
A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.
Scope: local
bookworm: resolved (fixed in 1:3.06.0.1-2)
bullseye: open
forky: resolved (fixed in 1:3.06.0.1-2)
sid: resolved (fixed in 1:3.06.0.1-2)
trixie: resolved (fixed in 1:3.06.0.1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-23
Published