Gentoo Security Advisory GLSA 200901-02 (jhead)

The remote host is missing updates announced in advisory GLSA 200901-02. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

GLSA-200901-02 : JHead: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200901-02 JHead: Multiple vulnerabilities Marc Merlin and John Dong reported multiple vulnerabilities in JHead: A buffer overflow in the DoCommand function when processing the cmd argument and related to potential string overflows...

CVE-2008-4639

jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file...

DEBIAN-CVE-2008-4641

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input...

DEBIAN-CVE-2008-4639

jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2008-4640

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which 1 a final "z" character is replaced by a "t" character or 2 a final "t" character is replaced by a "z" character...

CVE-2008-4639

jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2008-4641

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input...

DEBIAN-CVE-2008-4640

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which 1 a final "z" character is replaced by a "t" character or 2 a final "t" character is replaced by a "z" character...

Input validation

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input...

CVE-2008-4640

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which 1 a final "z" character is replaced by a "t" character or 2 a final "t" character is replaced by a "z" character...

CVE-2008-4641

CVE-2008-4641 affects the jhead utility (before 2.84) where DoCommand mishandles input, allowing execution of arbitrary shell commands via shell metacharacters. Public advisories across distributions (openSUSE, Fedora, Mandriva, SUSE/NASL) show the issue being addressed by updated jhead packages ...

CVE-2008-4639

jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file...

CVE-2008-4640

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which 1 a final "z" character is replaced by a "t" character or 2 a final "t" character is replaced by a "z" character...

CVE-2008-4641

The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input...

Fedora 9 : jhead-2.84-1.fc9 (2008-8928)

Thu Oct 16 2008 Adrian Reber - 2.84-1 - updated to 2.84 - fixes 'CVE-2008-4575 jhead buffer overflow' 467262 - removed upstreamed makefile patch - Wed Sep 24 2008 Adrian Reber - 2.82-2 - rebased makefile patch Note that Tenable Network Security has extracted the preceding description block...

Fedora 8 : jhead-2.84-1.fc8 (2008-8941)

Thu Oct 16 2008 Adrian Reber - 2.84-1 - updated to 2.84 - fixes 'CVE-2008-4575 jhead buffer overflow' 467262 - removed upstreamed makefile patch - Wed Sep 24 2008 Adrian Reber - 2.82-2 - rebased makefile patch - Sat Apr 5 2008 Adrian Reber - 2.82-1 - updated to 2.82 - Mon Feb 18 2008 Fedora...

[SECURITY] Fedora 8 Update: jhead-2.84-1.fc8

Jhead displays and manipulates the non-image portions of EXIF formatted JPEG images, such as the images produced by most digital cameras...

[SECURITY] Fedora 9 Update: jhead-2.84-1.fc9

Jhead displays and manipulates the non-image portions of EXIF formatted JPEG images, such as the images produced by most digital cameras...

DEBIAN-CVE-2008-4575

Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service crash via 1 a long -cmd argument and 2 unspecified vectors related to "a bunch of potential string overflows."...