Bug 879801 (CVE-2021-34055) – <media-gfx/jhead-3.06.0.1-r1: heap buffer overflow

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2022-11-05 01:14:40 UTC]

CVE-2021-34055:

jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u.

Patch is: https://github.com/Matthias-Wandel/jhead/commit/f0a884210cc46830b176f71fd61569adc8f230a7

Not sure if in any release

[Comment 1 Larry the Git Cow 2023-04-10 02:48:50 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ecf038d30f5cae49c82bed3af187d62387ed8c1e

commit ecf038d30f5cae49c82bed3af187d62387ed8c1e
Author:     Andreas K. Hüttel <[e-mail]>
AuthorDate: 2023-04-10 02:48:08 +0000
Commit:     Andreas K. Hüttel <[e-mail]>
CommitDate: 2023-04-10 02:48:38 +0000

    media-gfx/jhead: Add CVE-2021-34055 patch
    
    Bug: https://bugs.gentoo.org/879801
    Signed-off-by: Andreas K. Hüttel <[e-mail]>

 .../files/jhead-3.06.0.1-CVE-2021-34055.patch      | 108 +++++++++++++++++++++
 media-gfx/jhead/jhead-3.06.0.1-r1.ebuild           |  27 ++++++
 2 files changed, 135 insertions(+)

[Comment 2 Andreas K. Hüttel 2023-06-12 20:24:59 UTC]

Cleanup done

[Comment 3 Larry the Git Cow 2024-06-22 08:31:00 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=70a36362e8053f3760826b4ccce860e94299c700

commit 70a36362e8053f3760826b4ccce860e94299c700
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-06-22 08:28:39 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-06-22 08:29:13 +0000

    [ GLSA 202406-05 ] JHead: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/876247
    Bug: https://bugs.gentoo.org/879801
    Bug: https://bugs.gentoo.org/908519
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202406-05.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)