CVE-2022-41751 — OS Command Injection in Jhead

CWE-78 — OS Command Injection6 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 85.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Jhead Project JheadDebian JheadDebian Linux+1 more
Timeline
PublishedOct 17
Latest updateMay 25

Description

Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶debiandebian/jhead< jhead 1:3.06.0.1-3 (bookworm)
▶Debianjhead_project/jhead< 1:3.04-6+deb11u1+3
▶Ubuntujhead_project/jhead< 1:3.00-8~ubuntu0.2+4
▶NVDjhead_project/jhead3.06.0.1

Also affects: Debian Linux 10.0, 11.0, Fedora 35, 36, 37

🔴Vulnerability Details

3
OSV
Jhead vulnerabilities↗2023-05-25
▶
GHSA
GHSA-8m3f-vphm-cjhj: Jhead 3↗2022-10-17
▶
OSV
CVE-2022-41751: Jhead 3↗2022-10-17
▶

📋Vendor Advisories

2
Ubuntu
Jhead vulnerabilities↗2023-05-25
▶
Debian
CVE-2022-41751: jhead - Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them...↗2022
▶
CVE-2022-41751 — OS Command Injection in Debian Jhead | cvebase