exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data, aka internal bug 28868315.

This update for jhead fixes the following issues :

jhead was updated to 3.06.0.1

  - lot of fuzztest fixes

  - Apply a whole bunch of patches from Debian.

  - Spell check and fuzz test stuff from Debian, nothing     useful to human users.

  - Add option to set exif date from date from another file.

  - Bug fixes relating to fuzz testing.

  - Fix bug where thumbnail replacement DID NOT WORK.

  - Fix bug when no orientation tag is present

  - Fix bug of not clearing exif information when processing     images with an without exif data in one invocation.

  - Remove some unnecessary warnings with some types of GPS     data

  - Remove multiple copies of the same type of section when     deleting section types

This update for jhead fixes the following issues :

Security issues fixed :

  - CVE-2018-17088: The ProcessGpsInfo function may have     allowed a remote attacker to cause a denial-of-service     attack or unspecified other impact via a malicious JPEG     file, because there is an integer overflow during a     check for whether a location exceeds the EXIF data     length. This is analogous to the CVE-2016-3822 integer     overflow in exif.c. (boo#1108672)

  - CVE-2018-16554: The ProcessGpsInfo function may have     allowed a remote attacker to cause a denial-of-service     attack or unspecified other impact via a malicious JPEG     file, because of inconsistency between float and double     in a sprintf format string during TAG_GPS_ALT handling.
    (boo#1108480)

This update for jhead fixes the following security issues :

  - CVE-2016-3822: jhead remote attackers to execute     arbitrary code or cause a denial of service     (out-of-bounds access) via crafted EXIF data     (bsc#1108480).

  - CVE-2018-16554: The ProcessGpsInfo function may have     allowed a remote attacker to cause a denial-of-service     attack or unspecified other impact via a malicious JPEG     file, because of inconsistency between float and double     in a sprintf format string during TAG_GPS_ALT handling     (bsc#1108480).

It was discovered that jhead, a tool to manipulate the non-image part of EXIF compliant JPEG files, is prone to an out-of-bounds access vulnerability, which may result in denial of service or, potentially, the execution of arbitrary code if an image with specially crafted EXIF data is processed.

It was discovered that there was a vulnerability in jhead, a tool to manipulate the non-image part of EXIF-compliant JPEG files; remote attackers were able to execute arbitrary code via crafted image data.

For Debian 7 'Wheezy', this issue has been fixed in jhead version 1:2.95-1+deb7u1.

We recommend that you upgrade your jhead packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
149639	openSUSE Security Update : jhead (openSUSE-2021-743)	Nessus	SuSE Local Security Checks	high
123359	openSUSE Security Update : jhead (openSUSE-2019-858)	Nessus	SuSE Local Security Checks	high
123303	openSUSE Security Update : jhead (openSUSE-2019-698)	Nessus	SuSE Local Security Checks	high
118480	openSUSE Security Update : jhead (openSUSE-2018-1292)	Nessus	SuSE Local Security Checks	high
117692	openSUSE Security Update : jhead (openSUSE-2018-1044)	Nessus	SuSE Local Security Checks	high
99140	Debian DSA-3825-1 : jhead - security update	Nessus	Debian Local Security Checks	high
97898	Debian DLA-864-1 : jhead security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-3822

high

Tenable Plugins

high

high

high

high

high

high

high