CVE-2021-28277: 
NixOS vulnerability analysis and mitigation

A Heap-based Buffer Overflow vulnerability exists in jhead versions 3.04 and 3.05, specifically in the RemoveUnknownSections function within jpgfile.c. The vulnerability was discovered in early 2021 and affects the EXIF JPEG header manipulation tool (CVE Mitre, NVD).

The vulnerability manifests as a heap-based buffer overflow read operation in the RemoveUnknownSections function of jpgfile.c. The issue was identified through testing with AddressSanitizer, which revealed a buffer overflow when reading 80 bytes beyond the allocated memory region. The vulnerability can be triggered when processing specially crafted JPEG files (GitHub Issue).

When exploited, this vulnerability could lead to a denial of service condition by causing the application to crash. The issue affects multiple Linux distributions including Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, and 20.04 LTS (Ubuntu Notice).

The vulnerability can be triggered by processing a specially crafted JPEG file through the jhead application with the -purejpg option. A proof of concept has been publicly documented demonstrating the heap buffer overflow condition (GitHub Issue).

The vulnerability has been fixed in jhead version 3.06.0.1. Users are advised to upgrade to this version or later. Various Linux distributions have released security updates to address this vulnerability. For instance, Ubuntu has released patches for affected versions, and Gentoo recommends upgrading to version 3.06.0.1 or later (Gentoo Advisory, Ubuntu Notice).