load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gegl04Upgrade gegl04-devel | May 4, 2022 | Dec 23, 2021 |
| Alpine Linux | — | Upgrade gegl | Aug 22, 2024 | Dec 23, 2021 |
| Amazon Linux Ami 2 | — | Upgrade gegl-develUpgrade geglUpgrade gegl-debuginfo | Jul 4, 2022 | Dec 23, 2021 |
| Centos_linux | — | Upgrade gegl-debuginfoUpgrade gegl-develUpgrade gegl04-debugsourceUpgrade gegl04-tools-debuginfoUpgrade geglUpgrade gegl04-debuginfoUpgrade gegl04 | Feb 17, 2022 | Dec 23, 2021 |
| Debian | — | Upgrade gegl | Jul 30, 2024 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gegl | May 25, 2022 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade gegl | Mar 22, 2022 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gegl04 | Mar 29, 2022 | Dec 23, 2021 |
| Oracle_linux | — | Upgrade gegl04-develUpgrade gegl-develUpgrade geglUpgrade gegl04 | Jan 19, 2022 | Dec 15, 2021 |
| Redhat_linux | — | Upgrade gegl04-tools-debuginfoUpgrade gegl04-debugsourceUpgrade gegl04-debuginfoUpgrade gegl-develUpgrade gegl-debuginfoUpgrade gegl04-develUpgrade geglNo solution existsUpgrade gegl04 | Jan 19, 2022 | Dec 23, 2021 |
| Rocky_linux | — | Upgrade gegl04-debuginfoUpgrade gegl04Upgrade gegl04-develUpgrade gegl04-debugsource | Mar 12, 2024 | Dec 23, 2021 |
| Suse | — | Upgrade gegl-0_2-langUpgrade gegl-0_3-langUpgrade libgegl-0_4-0Upgrade gegl-docUpgrade gegl-0_3Upgrade libgegl-0_4-0-32bitUpgrade typelib-1_0-Gegl-0_4Upgrade gegl-0_2Upgrade geglUpgrade libgegl-0_2-0Upgrade gegl-develUpgrade gegl-0_4Upgrade libgegl-0_3-0Upgrade typelib-1_0-Gegl-0_3Upgrade gegl-0_4-lang | Dec 29, 2021 | Dec 23, 2021 |
| Ubuntu | — | Upgrade libgegl-0.3-0 (Ubuntu Pro)Upgrade gegl (Ubuntu Pro)Upgrade libgegl-0.4-0 (Ubuntu Pro)Upgrade libgegl-0.2-0 (Ubuntu Pro) | Mar 22, 2023 | Dec 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub