Log in Start free

Vulnerability · Published Feb 2, 2022 · Assigned by GitHub_M

CVE-2020-26208Heap-buffer-overflow in jhead

Medium 5.3

In plain English

A medium-severity out-of-bounds write in the jhead package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.9%top 40.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jhead1:3.04-6DEBIAN-CVE-2020-26208
Debian:13jhead1:3.04-6DEBIAN-CVE-2020-26208
Debian:14jhead1:3.04-6DEBIAN-CVE-2020-26208

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References