CVE-2021-3496
published 2021-04-22CVE-2021-3496: A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
PriorityP434high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.06%
60.8th percentile
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jhead | < jhead 1:3.04-6 (bookworm) | jhead 1:3.04-6 (bookworm) |
| jhead_project | jhead | — | — |
| jhead_project | jhead | — | — |
| jhead_project | jhead | >= 0 < 1:3.04-6 | 1:3.04-6 |
| jhead_project | jhead | >= 0 < 1:3.04-6 | 1:3.04-6 |
| jhead_project | jhead | >= 0 < 1:3.04-6 | 1:3.04-6 |
| jhead_project | jhead | >= 0 < 1:3.04-6 | 1:3.04-6 |
| jhead_project | jhead | >= 0 < 1:2.97-1+deb8u2ubuntu0.1~esm3 | 1:2.97-1+deb8u2ubuntu0.1~esm3 |
| jhead_project | jhead | >= 0 < 1:3.00-4+deb9u1ubuntu0.1~esm3 | 1:3.00-4+deb9u1ubuntu0.1~esm3 |
| jhead_project | jhead | >= 0 < 1:3.00-8~ubuntu0.2+esm1 | 1:3.00-8~ubuntu0.2+esm1 |
| jhead_project | jhead | >= 0 < 1:3.04-1ubuntu0.2+esm1 | 1:3.04-1ubuntu0.2+esm1 |
| jhead_project | jhead | >= 0 < 1:3.06.0.1-2ubuntu0.22.04.1+esm1 | 1:3.06.0.1-2ubuntu0.22.04.1+esm1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Jhead vulnerabilities
osv·2023-05-29·CVSS 5.5
CVE-2021-3496 [MEDIUM] Jhead vulnerabilities
Jhead vulnerabilities
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of servi
GHSA
GHSA-rvxv-5pj2-85pq: A heap-based buffer overflow was found in jhead in version 3
ghsa_unreviewed·2022-05-24
CVE-2021-3496 [HIGH] CWE-787 GHSA-rvxv-5pj2-85pq: A heap-based buffer overflow was found in jhead in version 3
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
OSV
CVE-2021-3496: A heap-based buffer overflow was found in jhead in version 3
osv·2021-04-22·CVSS 7.8
CVE-2021-3496 [HIGH] CVE-2021-3496: A heap-based buffer overflow was found in jhead in version 3
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
Ubuntu
Jhead vulnerabilities
vendor_ubuntu·2023-05-29·CVSS 5.5
CVE-2021-28277 [MEDIUM] Jhead vulnerabilities
Title: Jhead vulnerabilities
Summary: Jhead could be made to crash if it opened a specially crafted
file.
It was discovered that Jhead did not properly handle certain crafted Canon
images when processing them. An attacker could possibly use this issue to
crash Jhead, resulting in a denial of service. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
(CVE-2021-3496)
It was discovered that Jhead did not properly handle certain crafted images
when printing Canon-specific information. An attacker could possibly use this
issue to crash Jhead, resulting in a denial of service. This issue only
affected Ubuntu 20.04. (CVE-2021-28275)
It was discovered that Jhead did not properly handle certain crafted images
when removing unknown sections. An
Debian
CVE-2021-3496: jhead - A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in e...
vendor_debian·2021·CVSS 7.8
CVE-2021-3496 [HIGH] CVE-2021-3496: jhead - A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in e...
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.
Scope: local
bookworm: resolved (fixed in 1:3.04-6)
bullseye: resolved (fixed in 1:3.04-6)
forky: resolved (fixed in 1:3.04-6)
sid: resolved (fixed in 1:3.04-6)
trixie: resolved (fixed in 1:3.04-6)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-04-22
Published