jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.
{ "urgency": "not yet assigned" }