cbcvebase.
CVE-2021-3496
published 2021-04-22

CVE-2021-3496: A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.

PriorityP434high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.06%
60.8th percentile
A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.

Affected

12 ranges
VendorProductVersion rangeFixed in
debianjhead< jhead 1:3.04-6 (bookworm)jhead 1:3.04-6 (bookworm)
jhead_projectjhead
jhead_projectjhead
jhead_projectjhead>= 0 < 1:3.04-61:3.04-6
jhead_projectjhead>= 0 < 1:3.04-61:3.04-6
jhead_projectjhead>= 0 < 1:3.04-61:3.04-6
jhead_projectjhead>= 0 < 1:3.04-61:3.04-6
jhead_projectjhead>= 0 < 1:2.97-1+deb8u2ubuntu0.1~esm31:2.97-1+deb8u2ubuntu0.1~esm3
jhead_projectjhead>= 0 < 1:3.00-4+deb9u1ubuntu0.1~esm31:3.00-4+deb9u1ubuntu0.1~esm3
jhead_projectjhead>= 0 < 1:3.00-8~ubuntu0.2+esm11:3.00-8~ubuntu0.2+esm1
jhead_projectjhead>= 0 < 1:3.04-1ubuntu0.2+esm11:3.04-1ubuntu0.2+esm1
jhead_projectjhead>= 0 < 1:3.06.0.1-2ubuntu0.22.04.1+esm11:3.06.0.1-2ubuntu0.22.04.1+esm1

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8LOW
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.