Published: 05/08/2016 Updated: 05/11/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x prior to 4.4.4, 5.0.x prior to 5.0.2, 5.1.x prior to 5.1.1, and 6.x prior to 2016-08-01, allows remote malicious users to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data, aka internal bug 28868315.

Vulnerable Product	Search on Vulmon	Subscribe to Product
google android 6.0.1
google android 6.0
google android 4.1.2
google android 4.1
google android 4.0.4
google android 4.0.3
google android 5.1.0
google android 5.0.1
google android 4.3
google android 4.2.1
google android 4.0.1
google android 4.4.3
google android 4.4.2
google android 4.4.1
google android 4.4
google android 5.1
google android 5.0
google android 4.3.1
google android 4.2.2
google android 4.2
google android 4.0.2
google android 4.0
debian debian linux 9.0
debian debian linux 8.0

Debian Bug report logs - #858213 CVE-2016-3822 Package: jhead; Maintainer for jhead is Ludovic Rousseau <rousseau@debianorg>; Source for jhead is src:jhead (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 19 Mar 2017 20:54:01 UTC Severity: grave Tags: security, upstream Found in ve ...

Debian Bug report logs - #907925 jhead: CVE-2018-17088: Integer overflow in gpsinfoc while running jhead Package: jhead; Maintainer for jhead is Ludovic Rousseau <rousseau@debianorg>; Source for jhead is src:jhead (PTS, buildd, popcon) Reported by: Hanfang Zhang <hanfangzhang9@gmailcom> Date: Tue, 4 Sep 2018 07:3 ...

It was discovered that jhead, a tool to manipulate the non-image part of EXIF compliant JPEG files, is prone to an out-of-bounds access vulnerability, which may result in denial of service or, potentially, the execution of arbitrary code if an image with specially crafted EXIF data is processed For the stable distribution (jessie), this problem ha ...

CWE-119 https://android.googlesource.com/platform/external/jhead/+/bae671597d47b9e5955c4cb742e468cebfd7ca6b http://source.android.com/security/bulletin/2016-08-01.html http://www.securityfocus.com/bid/92226 http://www.debian.org/security/2017/dsa-3825 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858213 https://www.debian.org/security/./dsa-3825

CVE-2016-3822

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect