media-gfx/jhead-3.08-r1 — Security Advisories

▸ GLSA 202406-05 JHead: Multiple Vulnerabilities this version unaffected normal local 2024-06-22

Multiple vulnerabilities have been discovered in JHead, the worst of which may lead to arbitrary code execution.

Announced: 2024-06-22
Revised: 2024-06-22
Access: local
Bugs: #876247 #879801 #908519
Advisory: https://security.gentoo.org/glsa/202406-05

Affected packages

Package	Arch	Vulnerable	Unaffected
media-gfx/jhead	*	< 3.08	>= 3.08

Background

JHead is an EXIF JPEG header manipulation tool.

Description

Multiple vulnerabilities have been discovered in JHead. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All JHead users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.08"

References

▸ GLSA 202210-17 JHead: Multiple Vulnerabilities this version unaffected low remote 2022-10-31

Multiple vulnerabilities have been found in JHead, the worst of which could result in denial of service.

Announced: 2022-10-31
Revised: 2022-10-31
Access: remote
Bugs: #730746
Advisory: https://security.gentoo.org/glsa/202210-17

Affected packages

Package	Arch	Vulnerable	Unaffected
media-gfx/jhead	*	< 3.06.0.1	>= 3.06.0.1

Background

JHead is an EXIF JPEG header manipulation tool.

Description

Multiple vulnerabilities have been discovered in JHead. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All JHead users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.06.0.1"

References

▸ GLSA 202007-17 JHead: Multiple vulnerabilities this version unaffected normal remote 2020-07-26

Multiple vulnerabilities have been found in JHead, the worst of which could result in a Denial of Service condition.

Announced: 2020-07-26
Revised: 2020-07-27 (revision 2)
Access: remote
Bugs: #701826 #711220
Advisory: https://security.gentoo.org/glsa/202007-17

Affected packages

Package	Arch	Vulnerable	Unaffected
media-gfx/jhead	*	< 3.04	>= 3.04

Background

JHead is an exif jpeg header manipulation tool.

Description

Multiple vulnerabilities have been discovered in JHead. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All JHead users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.04"

References

▸ GLSA 200901-02 JHead: Multiple vulnerabilities this version unaffected normal remote 2009-01-11

Multiple vulnerabilities in JHead might lead to the execution of arbitrary code or data loss.

Announced: 2009-01-11
Revised: 2009-01-11
Access: remote
Bugs: #242702 #243238
Advisory: https://security.gentoo.org/glsa/200901-02

Affected packages

Package	Arch	Vulnerable	Unaffected
media-gfx/jhead	*	< 2.84-r1	>= 2.84-r1

Background

JHead is an exif jpeg header manipulation tool.

Description

Marc Merlin and John Dong reported multiple vulnerabilities in JHead:

A buffer overflow in the DoCommand() function when processing the cmd argument and related to potential string overflows (CVE-2008-4575).
An insecure creation of a temporary file (CVE-2008-4639).
A error when unlinking a file (CVE-2008-4640).
Insufficient escaping of shell metacharacters (CVE-2008-4641).

Impact

A remote attacker could possibly execute arbitrary code by enticing a user or automated system to open a file with a long filename or via unspecified vectors. It is also possible to trick a user into deleting or overwriting files.

Workaround

There is no known workaround at this time.

Resolution

All JHead users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/jhead-2.84-r1"