A security issue has been reported in JHead, which potentially can be exploited by malicious, local users to gain escalated privileges.

The security issue is caused due to a boundary error within the "DoCommand()" function in jhead.c. This can be exploited to cause a stack-based buffer overflow by tricking a user into using the "-cmd" argument to process a file having an overly long filename.

NOTE: Other similar security issues are reportedly also present.

This security issue is reported in versions prior to 2.84.

Solution
Update to version 2.84.

Provided and/or discovered by
Reported by Marc Merlin and John Dong in an Ubuntu bug report.

Original Advisory
https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/271020

http://www.sentex.net/~mwandel/jhead/changes.txt

Deep Links
Links available in Customer Area