CVE-2021-28277
published 2022-03-23CVE-2021-28277: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
PriorityP337high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.85%
54.0th percentile
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jhead | < jhead 1:3.06.0.1-2 (bookworm) | jhead 1:3.06.0.1-2 (bookworm) |
| jhead_project | jhead | — | — |
| jhead_project | jhead | — | — |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2 | 1:3.06.0.1-2 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2 | 1:3.06.0.1-2 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2 | 1:3.06.0.1-2 |
| jhead_project | jhead | >= 0 < 1:2.97-1+deb8u2ubuntu0.1~esm3 | 1:2.97-1+deb8u2ubuntu0.1~esm3 |
| jhead_project | jhead | >= 0 < 1:3.00-4+deb9u1ubuntu0.1~esm3 | 1:3.00-4+deb9u1ubuntu0.1~esm3 |
| jhead_project | jhead | >= 0 < 1:3.00-8~ubuntu0.2+esm1 | 1:3.00-8~ubuntu0.2+esm1 |
| jhead_project | jhead | >= 0 < 1:3.04-1ubuntu0.2+esm1 | 1:3.04-1ubuntu0.2+esm1 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2ubuntu0.22.04.1+esm1 | 1:3.06.0.1-2ubuntu0.22.04.1+esm1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Jhead vulnerabilities
osv·2023-05-29·CVSS 5.5
CVE-2021-3496 [MEDIUM] Jhead vulnerabilities
Jhead vulnerabilities
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of servi
GHSA
GHSA-95g4-8wpg-6c5r: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3
ghsa_unreviewed·2022-03-24
CVE-2021-28277 [HIGH] CWE-787 GHSA-95g4-8wpg-6c5r: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
OSV
CVE-2021-28277: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3
osv·2022-03-23·CVSS 7.8
CVE-2021-28277 [HIGH] CVE-2021-28277: A Heap-based Buffer Overflow vulnerabilty exists in jhead 3
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
Ubuntu
Jhead vulnerabilities
vendor_ubuntu·2023-05-29·CVSS 5.5
CVE-2021-28277 [MEDIUM] Jhead vulnerabilities
Title: Jhead vulnerabilities
Summary: Jhead could be made to crash if it opened a specially crafted
file.
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An
Debian
CVE-2021-28277: jhead - A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affec...
vendor_debian·2021·CVSS 7.8
CVE-2021-28277 [HIGH] CVE-2021-28277: jhead - A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affec...
A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.
Scope: local
bookworm: resolved (fixed in 1:3.06.0.1-2)
bullseye: open
forky: resolved (fixed in 1:3.06.0.1-2)
sid: resolved (fixed in 1:3.06.0.1-2)
trixie: resolved (fixed in 1:3.06.0.1-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-03-23
Published