JHead: Multiple Vulnerabilities

Background JHead is an EXIF JPEG header manipulation tool. Description Multiple vulnerabilities have been discovered in JHead. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround a...

GLSA-202210-28 : exif: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202210-28 exif: Denial of Service - NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service DoS by uploading a...

Fedora: Security Advisory for jhead (FEDORA-2022-61ec901852)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for jhead (FEDORA-2022-1d9133bc8e)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: jhead-3.06.0.1-5.fc35

Jhead displays and manipulates the non-image portions of EXIF formatted JPEG images, such as the images produced by most digital cameras...

[SECURITY] Fedora 36 Update: jhead-3.06.0.1-5.fc36

Jhead displays and manipulates the non-image portions of EXIF formatted JPEG images, such as the images produced by most digital cameras...

PT-2022-7117 · Unknown +1 · Openimageio +1

Name of the Vulnerable Software and Affected Versions: OpenImageIO versions prior to the fixed version Description: The issue is related to the add exif item to spec function in the OpenImageIO library, which can lead to stack-based memory corruption when processing specially-crafted exif metadat...

GHSA-PX9G-8HGV-JVG2 kamadak-exif vulnerable to Infinite loop when parsing PNG files

Impact Reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. Patches Version 0.5.3 includes the fix. Workarounds No workaround is available. Applications that do not pass files with the PNG signature to Reader::readfromcontainer are not affected. References For mo...

kamadak-exif vulnerable to Infinite loop when parsing PNG files

Impact Reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. Patches Version 0.5.3 includes the fix. Workarounds No workaround is available. Applications that do not pass files with the PNG signature to Reader::readfromcontainer are not affected. References For mo...

Security update for pngcheck (moderate)

openSUSE Security Update: Security update for pngcheck Announcement ID: openSUSE-SU-2022:10142-1 Rating: moderate References: 1202662 Cross-References: CVE-2020-35511 CVSS scores: CVE-2020-35511 NVD : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP...

OPENSUSE-SU-2022:10142-1 Security update for pngcheck

This update for pngcheck fixes the following issues: version update to 3.0.3 boo1202662 fixed a crash bug and probable vulnerability in large MNG LOOP chunks fixed a divide-by-zero crash bug and probable vulnerability in interlaced images with extra compressed data beyond the nominal end of the...

Ubuntu: Security Advisory (USN-112-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-rwcarlsen-goexif-0-0.10.20191017git9e8deec.fc36

This package provides decoding of basic exif and tiff encoded data...

[SECURITY] Fedora 35 Update: golang-github-rwcarlsen-goexif-0-0.9.20191017git9e8deec.fc35

This package provides decoding of basic exif and tiff encoded data...

Malicious code in load-image-exif (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c314aa9b8893f20f40e6ab9b53ab508347aa09e376589762f1a429e1cdd33a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4338 Malicious code in load-image-exif (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c314aa9b8893f20f40e6ab9b53ab508347aa09e376589762f1a429e1cdd33a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-559 Malicious code in @remove-bg/exif-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3beec8c73b102d14d90b0183523c9a64de0e97e6205b10e6321c36ffc84d574 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Metadata Is Not Stripped From Images

While uploading an image on https://demo-publify.herokuapp.com/admin/resources as a low privileged user the meta data of the image like geolocation, device information, version, name etc is not getting stripped, as a result the attacker can collect all the meta data information of the image by...

SUSE SLED15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2022:1768-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1768-1 advisory. - Fixed filtervar bypass vulnerability bsc1197644. Tenable has extracted the preceding description block...