Unrated
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by us...
CVE-2021-45463
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-45463 gegl Fixed in: 1:0.4.34-1
Original description The description as published by the source.
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
References
- advisory gitlab.gnome.org
- advisory gitlab.gnome.org
- advisory gimp.org
- patch gitlab.gnome.org
- patch gitlab.gnome.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org