CVE-2022-41751: OS Command Injection
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/jheadto a version that resolves this vulnerability.Fixed in 1:3.00-8+deb10u1Fixed in 1:3.04-6+deb11u1Fixed in 1:3.06.0.1-6Fixed in 1:3.08-2 - Upgrade
Upgrade
debian/jheadto a version that resolves this vulnerability.Fixed in 1:3.06.0.1-3Fixed in 1:3.04-6+deb11u1
Event History
Frequently Asked Questions
What is CVE-2022-41751?
CVE-2022-41751 refers to a vulnerability in Jhead 3.06.0.1 that allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and using the regeneration -rgt50 option.
What is the severity of CVE-2022-41751?
The severity of CVE-2022-41751 is high, with a CVSS score of 7.8.
How does CVE-2022-41751 impact Jhead?
CVE-2022-41751 allows attackers to execute arbitrary OS commands in Jhead 3.06.0.1 by manipulating JPEG filenames.
Which software versions are affected by CVE-2022-41751?
Jhead 3.06.0.1 is affected by CVE-2022-41751. Additionally, Fedora 35, Fedora 36, Fedora 37, Debian Linux 10.0, and Debian Linux 11.0 are also affected.
How can I fix CVE-2022-41751?
To fix CVE-2022-41751, you should update Jhead to a version that includes the necessary security patches.