[gentoo-announce] [ GLSA 202210-17 ] JHead: Multiple Vulnerabilities - gentoo-announce

From:	glsamaker@g.o
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202210-17 ] JHead: Multiple Vulnerabilities
Date:	Mon, 31 Oct 2022 02:07:36
Message-Id:	`166717874839.9.2873837822113349758@90bb6a0775af`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202210-17

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Low

8

    Title: JHead: Multiple Vulnerabilities

9

     Date: October 31, 2022

10

     Bugs: #730746

11

       ID: 202210-17

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in JHead, the worst of which

19

could result in denial of service.

20

21

Background

22

==========

23

24

JHead is an EXIF JPEG header manipulation tool.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  media-gfx/jhead            < 3.06.0.1                >= 3.06.0.1

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in JHead. Please review

38

the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

Please review the referenced CVE identifiers for details.

44

45

Workaround

46

==========

47

48

There is no known workaround at this time.

49

50

Resolution

51

==========

52

53

All JHead users should upgrade to the latest version:

54

55

  # emerge --sync

56

  # emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.06.0.1"

57

58

References

59

==========

60

61

[ 1 ] CVE-2021-3496

62

      https://nvd.nist.gov/vuln/detail/CVE-2021-3496

63

[ 2 ] CVE-2021-28275

64

      https://nvd.nist.gov/vuln/detail/CVE-2021-28275

65

[ 3 ] CVE-2021-28276

66

      https://nvd.nist.gov/vuln/detail/CVE-2021-28276

67

[ 4 ] CVE-2021-28277

68

      https://nvd.nist.gov/vuln/detail/CVE-2021-28277

69

[ 5 ] CVE-2021-28278

70

      https://nvd.nist.gov/vuln/detail/CVE-2021-28278

71

72

Availability

73

============

74

75

This GLSA and any updates to it are available for viewing at

76

the Gentoo Security Website:

77

78

 https://security.gentoo.org/glsa/202210-17

79

80

Concerns?

81

=========

82

83

Security is a primary focus of Gentoo Linux and ensuring the

84

confidentiality and security of our users' machines is of utmost

85

importance to us. Any security concerns should be addressed to

86

security@g.o or alternatively, you may file a bug at

87

https://bugs.gentoo.org.

88

89

License

90

=======

91

92

Copyright 2022 Gentoo Foundation, Inc; referenced text

93

belongs to its owner(s).

94

95

The contents of this document are licensed under the

96

Creative Commons - Attribution / Share Alike license.

97

98

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202210-17
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Low
8	Title: JHead: Multiple Vulnerabilities
9	Date: October 31, 2022
10	Bugs: #730746
11	ID: 202210-17
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in JHead, the worst of which
19	could result in denial of service.
20
21	Background
22	==========
23
24	JHead is an EXIF JPEG header manipulation tool.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 media-gfx/jhead < 3.06.0.1 >= 3.06.0.1
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in JHead. Please review
38	the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	Please review the referenced CVE identifiers for details.
44
45	Workaround
46	==========
47
48	There is no known workaround at this time.
49
50	Resolution
51	==========
52
53	All JHead users should upgrade to the latest version:
54
55	# emerge --sync
56	# emerge --ask --oneshot --verbose ">=media-gfx/jhead-3.06.0.1"
57
58	References
59	==========
60
61	[ 1 ] CVE-2021-3496
62	https://nvd.nist.gov/vuln/detail/CVE-2021-3496
63	[ 2 ] CVE-2021-28275
64	https://nvd.nist.gov/vuln/detail/CVE-2021-28275
65	[ 3 ] CVE-2021-28276
66	https://nvd.nist.gov/vuln/detail/CVE-2021-28276
67	[ 4 ] CVE-2021-28277
68	https://nvd.nist.gov/vuln/detail/CVE-2021-28277
69	[ 5 ] CVE-2021-28278
70	https://nvd.nist.gov/vuln/detail/CVE-2021-28278
71
72	Availability
73	============
74
75	This GLSA and any updates to it are available for viewing at
76	the Gentoo Security Website:
77
78	https://security.gentoo.org/glsa/202210-17
79
80	Concerns?
81	=========
82
83	Security is a primary focus of Gentoo Linux and ensuring the
84	confidentiality and security of our users' machines is of utmost
85	importance to us. Any security concerns should be addressed to
86	security@g.o or alternatively, you may file a bug at
87	https://bugs.gentoo.org.
88
89	License
90	=======
91
92	Copyright 2022 Gentoo Foundation, Inc; referenced text
93	belongs to its owner(s).
94
95	The contents of this document are licensed under the
96	Creative Commons - Attribution / Share Alike license.
97
98	https://creativecommons.org/licenses/by-sa/2.5