VDB
CVE-2020-26208
CVE-2020-26208
PUBLISHED
CVSS 6.099999904632568 MEDIUM
JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.
EPSS 0.89% · 57.0th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS Score
0.89%
57.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:14.04:LTS | jhead | 1:2.97-1+deb8u2build0.14.04.1~esm1, 1:2.97-1+deb8u1build0.14.04.1, 1:2.97-1 |
| Ubuntu:18.04:LTS | jhead | *, 0, 1:3.00-4 |
| Ubuntu:20.04:LTS | jhead | *, 0, 1:3.04-1 |
| Ubuntu:Pro:16.04:LTS | jhead | 0, 1:3.00-2, 1:3.00-3 |
Timeline
- Feb 2, 2022 CVE Published
- Feb 3, 2022 EPSS Score
- Mar 28, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 11, 2022 EPSS Score
- Sep 3, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-26208 third-party-advisory
- https://github.com/Matthias-Wandel/jhead/commit/5186ddcf9e35a7aa0ff0539489a930434a1325f4 third-party-advisory
- https://github.com/Matthias-Wandel/jhead/issues/7 third-party-advisory
- https://sources.debian.org/src/jhead/1%3A3.04-6/debian/patches/allocate-extra.patch/ third-party-advisory
- https://ubuntu.com/security/notices/USN-6098-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-26208 third-party-advisory