Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perl-image-exiftool | Aug 22, 2024 | Apr 23, 2021 |
| Debian | — | Upgrade libimage-exiftool-perl | May 4, 2021 | Apr 23, 2021 |
| Freebsd | — | Upgrade p5-Image-ExifTool | Nov 4, 2022 | Mar 25, 2022 |
| Gentoo Linux | — | Upgrade media-libs/exiftool. | Jul 25, 2024 | Apr 23, 2021 |
| Suse | — | Upgrade perl-file-randomaccessUpgrade exiftoolUpgrade perl-image-exiftool | May 11, 2021 | Apr 23, 2021 |
| Ubuntu | — | Upgrade libimage-exiftool-perlUpgrade libimage-exiftool-perl (Ubuntu Pro) | Jun 11, 2021 | Apr 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub