Libgphoto2
Monthly
Stack- and heap-based buffer overflows in libgphoto2 through 2.5.34's jl2005c_init() can corrupt memory and potentially permit code execution when a malicious USB device impersonates a Jeilin JL2005B/C/D camera. Exploitation requires physical attachment of the spoofed device; once enumerated by the jl2005c driver, a device-reported allocation-table entry count of 1022 or more overflows the local stack 'info' buffer and the heap priv->table buffer. The attack needs no authentication or user interaction beyond device enumeration, and the supplied data identifies upstream fixes but no confirmed active exploitation (CISA KEV) or verified working exploit code.
Heap memory corruption in libgphoto2 (through 2.5.34) lets a malicious USB camera driven by the jl2005c camlib overrun a heap buffer by roughly 30 KB during thumbnail decompression, leaking heap contents into generated preview images and allowing memory writes past the allocation. Only hosts that physically connect the crafted device and have the application process the thumbnail/preview are exposed, and the jl2005c code path must actually be reached, which keeps this a medium/low-urgency issue rather than a high-priority emergency. No public exploit code and no CISA KEV listing are confirmed in the available data, and authentication is not required (CVSS 4.0 PR:N) although the attack vector is physical (AV:P).
Stack- and heap-based buffer overflows in libgphoto2 through 2.5.34's jl2005c_init() can corrupt memory and potentially permit code execution when a malicious USB device impersonates a Jeilin JL2005B/C/D camera. Exploitation requires physical attachment of the spoofed device; once enumerated by the jl2005c driver, a device-reported allocation-table entry count of 1022 or more overflows the local stack 'info' buffer and the heap priv->table buffer. The attack needs no authentication or user interaction beyond device enumeration, and the supplied data identifies upstream fixes but no confirmed active exploitation (CISA KEV) or verified working exploit code.
Heap memory corruption in libgphoto2 (through 2.5.34) lets a malicious USB camera driven by the jl2005c camlib overrun a heap buffer by roughly 30 KB during thumbnail decompression, leaking heap contents into generated preview images and allowing memory writes past the allocation. Only hosts that physically connect the crafted device and have the application process the thumbnail/preview are exposed, and the jl2005c code path must actually be reached, which keeps this a medium/low-urgency issue rather than a high-priority emergency. No public exploit code and no CISA KEV listing are confirmed in the available data, and authentication is not required (CVSS 4.0 PR:N) although the attack vector is physical (AV:P).