Published: 23/12/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

load_cache in GEGL prior to 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases prior to 0.4.34 are used in GIMP releases prior to 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gegl gegl
gimp gimp
redhat enterprise linux 7.0
redhat enterprise linux 8.0
fedoraproject fedora 34
fedoraproject fedora 35

Debian Bug report logs - #1002661 gegl: CVE-2021-45463 Package: src:gegl; Maintainer for src:gegl is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 26 Dec 2021 21:03:01 UTC Severity: important Tags: security, upstream Found i ...

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity (CVE-2021-45463) ...

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity ...

NVD-CWE-noinfo https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b https://gitlab.gnome.org/GNOME/gegl/-/blob/master/docs/NEWS.adoc https://gitlab.gnome.org/GNOME/gimp/-/commit/e8a31ba4f2ce7e6bc34882dc27c97fba993f5868 https://www.gimp.org/news/2021/12/21/gimp-2-10-30-released/https://gitlab.gnome.org/GNOME/gegl/-/issues/298 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG635WJCNXHJM5U4BGMAAP4NK2YFTQXK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP5NDNOTMPI335FXE7VUPW7FXYTT7PYN/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1002661 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2022-1755.html

CVE-2021-45463

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect