ALT-PU-2025-2035-3
Closed vulnerabilities
Published: 2022-10-17
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2022-41751
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option.
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://github.com/Matthias-Wandel/jhead
- https://github.com/Matthias-Wandel/jhead
- https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788
- https://github.com/Matthias-Wandel/jhead/blob/63ce118c6a59ea64ac357236a11a47aaf569d622/jhead.c#L788
- https://github.com/Matthias-Wandel/jhead/pull/57
- https://github.com/Matthias-Wandel/jhead/pull/57
- [debian-lts-announce] 20221204 [SECURITY] [DLA 3219-1] jhead security update
- [debian-lts-announce] 20221204 [SECURITY] [DLA 3219-1] jhead security update
- FEDORA-2022-628829f0e6
- FEDORA-2022-628829f0e6
- FEDORA-2022-1d9133bc8e
- FEDORA-2022-1d9133bc8e
- FEDORA-2022-61ec901852
- FEDORA-2022-61ec901852
- DSA-5294
- DSA-5294