Unscored severity · published Oct 21, 2008
CVE-2008-4641
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input
–
CVSS
2.2%
EPSS
No
On KEV
Description
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows attackers to execute arbitrary commands via shell metacharacters in unspecified input.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JH
Jhead · Sentex
through 2.82; 1.2; 1.3; 1.4; 1.5; 1.6; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4641
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/10/15/5
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/10/15/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/10/16/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2008/11/26/4
www.securityfocus.com
http://www.securityfocus.com/bid/31921
bugs.launchpad.net
https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/271020
More from Jhead
–
CVE-2008-4640
The DoCommand function in jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to delete arbitrary files via vectors involving a modified input filename in which…
–
CVE-2008-4639
jhead.c in Matthias Wandel jhead 2.84 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file
–
CVE-2008-4575
Buffer overflow in the DoCommand function in jhead before 2.84 might allow context-dependent attackers to cause a denial of service (crash) via (1) a long -cmd argument and (2)…