Theprotagonist07

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.