DSA-5294: -1 jhead -- security update

Published Dec 4, 2022

Updated

jhead - security update

Other sources

Jhead, a tool for manipulating EXIF data embedded in JPEG images, allowed attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50, -autorot or -ce option. In addition a buffer overflow error in exif.c has been addressed which could lead to a denial of service (application crash).

Affected Software

2 affected components

debian/jhead

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade jhead to a version that resolves this vulnerability.
Patch DSA-5294-1

Event History

Dec 4, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What must an attacker control to exploit the command-execution issue?

The attacker must be able to supply or cause processing of a JPEG file whose filename contains operating-system commands, and the file must be handled using the -rgt50, -autorot, or -ce option.

Which jhead operations are implicated in arbitrary command execution?

The affected operations are regeneration with -rgt50, automatic rotation with -autorot, and the -ce option. The described command injection occurs when these options process a malicious JPEG filename.

What is the impact of the separate memory-safety issue?

A buffer overflow in exif.c could cause a denial of service by crashing the application. The provided information does not describe code execution from this overflow.

DSA-5294: -1 jhead -- security update

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker control to exploit the command-execution issue?

Which jhead operations are implicated in arbitrary command execution?

What is the impact of the separate memory-safety issue?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to exploit the command-execution issue?

Which jhead operations are implicated in arbitrary command execution?

What is the impact of the separate memory-safety issue?