CVE catalog

CVE-2021-28275

jhead: CVE-2021-28275

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.66% · Oct 25, 2026

A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exif.c in will cause segmentation fault via a crafted_file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjheadsid1:3.08-3fixed
Debianjheadforky1:3.08-3fixed
Debianjheadtrixie1:3.08-3fixed
Debianjheadbookworm1:3.06.0.1-6fixed
Ubuntujheadpro1:3.04-6vulnerable
Ubuntujheadpro1:3.06.0.1-2vulnerable
Ubuntujheadpro1:3.06.0.1-2ubuntu0.22.04.1vulnerable
Ubuntujheadpro1:3.06.0.1-2ubuntu0.22.04.1+esm1fixed
Ubuntujheadpro1:3.03-3vulnerable
Ubuntujheadpro1:3.04-1vulnerable
Ubuntujheadpro1:3.04-1ubuntu0.1vulnerable
Ubuntujheadpro1:3.04-1ubuntu0.2vulnerable
Ubuntujheadpro1:3.04-1ubuntu0.2+esm1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjheadsourcesid1:3.06.0.1-2unimportantNot reportedNot reported
Debianjheadsourceforky1:3.06.0.1-2unimportantNot reportedNot reported
Debianjheadsourcetrixie1:3.06.0.1-2unimportantNot reportedNot reported
Debianjheadsourcebookworm1:3.06.0.1-2unimportantNot reportedNot reported
Ubuntujheaddebpro1:3.06.0.1-2ubuntu0.22.04.1+esm1Not reportedUSN-6110-1Not reported
Ubuntujheaddebpro1:3.04-1ubuntu0.2+esm1Not reportedUBUNTU-CVE-2021-28275Not reported

OpenFactory catalog packages

Vulnerability data is temporarily unavailable.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]