Bug 730746 – <media-gfx/jhead-3.06.0.1: Multiple vulnerabilities (CVE-2020-{6624,6625}, CVE-2021-3496)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2020-07-04 18:18:27 UTC]

See https://bugs.gentoo.org/711220#c1.

[Comment 1 John Helmert III 2021-06-24 03:22:03 UTC]

CVE-2021-3496:

A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.

Issue: https://github.com/Matthias-Wandel/jhead/issues/33

Fixed in 3.06.0.1.

[Comment 2 John Helmert III 2022-03-24 00:51:59 UTC]

CVE-2021-28275 (https://github.com/Matthias-Wandel/jhead/issues/17):

A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.

CVE-2021-28276 (https://github.com/Matthias-Wandel/jhead/issues/1):

A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMakerNoteDir function in makernote.c.

CVE-2021-28277 (https://github.com/Matthias-Wandel/jhead/issues/16):

A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via the RemoveUnknownSections function in jpgfile.c.

CVE-2021-28278 (https://github.com/Matthias-Wandel/jhead/issues/15):

A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in jpgfile.c.

These all fixed by 3.06.0.1.

[Comment 3 Larry the Git Cow 2022-10-08 22:35:56 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a47a1d8535d26adffaf93b0df37a623ed2e629c5

commit a47a1d8535d26adffaf93b0df37a623ed2e629c5
Author:     Andreas K. Hüttel <[e-mail]>
AuthorDate: 2022-10-08 22:30:53 +0000
Commit:     Andreas K. Hüttel <[e-mail]>
CommitDate: 2022-10-08 22:35:44 +0000

    media-gfx/jhead: add 3.06.0.1
    
    Bug: https://bugs.gentoo.org/730746
    Signed-off-by: Andreas K. Hüttel <[e-mail]>

 media-gfx/jhead/Manifest                           |  1 +
 .../jhead-3.06.0.1-mkstemp-fix-makefile.patch      | 52 ++++++++++++++++++++++
 media-gfx/jhead/jhead-3.06.0.1.ebuild              | 24 ++++++++++
 3 files changed, 77 insertions(+)

[Comment 4 John Helmert III 2022-10-09 03:34:30 UTC]

I suppose we should move the fixed ones to a new bug this time, so the two unfixed bugs aren't moved to a *third* bug.

[Comment 5 John Helmert III 2022-10-21 18:13:45 UTC]

(In reply to John Helmert III from comment #4)
> I suppose we should move the fixed ones to a new bug this time, so the two
> unfixed bugs aren't moved to a *third* bug.

Well, I said that then did the opposite. Whoops.

[Comment 6 John Helmert III 2022-10-21 18:14:51 UTC]

GLSA request filed.

[Comment 7 Larry the Git Cow 2022-10-31 01:41:42 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=076fd7121bedf4e031ffbdb82f78d30568739b09

commit 076fd7121bedf4e031ffbdb82f78d30568739b09
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2022-10-31 01:12:23 +0000
Commit:     John Helmert III <[e-mail]>
CommitDate: 2022-10-31 01:40:15 +0000

    [ GLSA 202210-17 ] JHead: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/730746
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: John Helmert III <[e-mail]>

 glsa-202210-17.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

[Comment 8 Hanno Böck 2022-11-01 10:12:08 UTC]

It seems a GLSA was issued here before stabilization. Was this intentional?

On stable systems users will get a glsa warning without an upgrade path.

[Comment 9 John Helmert III 2022-11-01 15:16:37 UTC]

(In reply to Hanno Böck from comment #8)
> It seems a GLSA was issued here before stabilization. Was this intentional?
> 
> On stable systems users will get a glsa warning without an upgrade path.

No! This was definitely done in error. I'll stablereq now, and I apologize for the oversight.

[Comment 10 John Helmert III 2022-11-01 15:53:24 UTC]

Stabilization done, all done!