CVE-2022-41751

NameCVE-2022-41751
DescriptionJhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs1022028

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jhead (PTS)buster1:3.00-8vulnerable
bullseye1:3.04-6vulnerable
bookworm1:3.06.0.1-5fixed
sid1:3.06.0.1-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jheadsource(unstable)1:3.06.0.1-31022028

Notes

https://github.com/Matthias-Wandel/jhead/pull/57
https://github.com/Matthias-Wandel/jhead/commit/6985da52c9ad4f5f6c247269cb5508fae34a971c
https://github.com/Matthias-Wandel/jhead/commit/3fe905cf674f8dbac8a89e58cee1b4850abf9530
Fixes are insufficient: https://github.com/Matthias-Wandel/jhead/issues/60
https://github.com/Matthias-Wandel/jhead/commit/ec67262b8e5a4b05d8ad6898a09f1dc3fc032062
Further followup (bug #1023303): https://github.com/Matthias-Wandel/jhead/issues/65

Search for package or bug name: Reporting problems