CVE-2019-1010302

jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file.

Updated jhead package fixes security vulnerabilities:

jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file (CVE-2019-19035).

A vulnerability was found in jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file (CVE-2019-1010301).

A vulnerability was found in jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file (CVE-2019-1010302).

This update for jhead fixes the following issues:

jhead was updated to 3.06.0.1

• lot of fuzztest fixes
• Apply a whole bunch of patches from Debian.
• Spell check and fuzz test stuff from Debian, nothing useful to human users.
• Add option to set exif date from date from another file.
• Bug fixes relating to fuzz testing.
• Fix bug where thumbnail replacement DID NOT WORK.
• Fix bug when no orientation tag is present
• Fix bug of not clearing exif information when processing images with an without exif data in one invocation.
• Remove some unnecessary warnings with some types of GPS data
• Remove multiple copies of the same type of section when deleting section types

This update for jhead fixes the following issues:

jhead was updated to 3.06.0.1

• lot of fuzztest fixes
• Apply a whole bunch of patches from Debian.
• Spell check and fuzz test stuff from Debian, nothing useful to human users.
• Add option to set exif date from date from another file.
• Bug fixes relating to fuzz testing.
• Fix bug where thumbnail replacement DID NOT WORK.
• Fix bug when no orientation tag is present
• Fix bug of not clearing exif information when processing images with an without exif data in one invocation.
• Remove some unnecessary warnings with some types of GPS data
• Remove multiple copies of the same type of section when deleting section types

This update was imported from the openSUSE:Leap:15.2:Update update project.

It was discovered that Jhead did not properly handle certain crafted images while processing the JFIF markers. An attacker could cause Jhead to crash. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2019-19035)

It was discovered that Jhead did not properly handle certain crafted images while processing longitude tags. An attacker could cause Jhead to crash. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010301)

It was discovered that Jhead did not properly handle certain crafted images while processing IPTC data. An attacker could cause Jhead to crash. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010302)

Binbin Li discovered that Jhead did not properly handle certain crafted images while processing the DQT data. An attacker could cause Jhead to crash. (CVE-2020-6624)

Binbin Li discovered that Jhead did not properly handle certain crafted images while processing longitude data. An attacker could cause Jhead to crash. (CVE-2020-6625)

Feng Zhao Yang discovered that Jhead did not properly handle certain crafted images while reading JPEG sections. An attacker could cause Jhead to crash. (CVE-2020-26208)

It was discovered that Jhead did not properly handle certain crafted images while processing Canon images. An attacker could cause Jhead to crash. (CVE-2021-28276)

It was discovered that Jhead did not properly handle certain crafted images when removing a certain type of sections. An attacker could cause Jhead to crash. (CVE-2021-28278)