load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gegl04Upgrade gegl04-devel | May 4, 2022 | Dec 23, 2021 |
| Alpine Linux | — | Upgrade gegl | Aug 22, 2024 | Dec 23, 2021 |
| Amazon Linux Ami 2 | — | Upgrade geglUpgrade gegl-debuginfoUpgrade gegl-devel | Jul 4, 2022 | Dec 23, 2021 |
| Centos_linux | — | Upgrade gegl04Upgrade gegl04-debuginfoUpgrade gegl04-tools-debuginfoUpgrade gegl-debuginfoUpgrade geglUpgrade gegl04-debugsourceUpgrade gegl-devel | Feb 17, 2022 | Dec 23, 2021 |
| Debian | — | Upgrade gegl | Jul 30, 2024 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp3 | — | Upgrade gegl | May 25, 2022 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade gegl | Mar 22, 2022 | Dec 23, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade gegl04 | Mar 29, 2022 | Dec 23, 2021 |
| Oracle_linux | — | Upgrade gegl04-develUpgrade gegl-develUpgrade gegl04Upgrade gegl | Jan 19, 2022 | Dec 15, 2021 |
| Redhat_linux | — | Upgrade gegl04Upgrade gegl04-debugsourceUpgrade gegl-debuginfoUpgrade gegl-develUpgrade gegl04-develUpgrade gegl04-tools-debuginfoNo solution existsUpgrade gegl04-debuginfoUpgrade gegl | Jan 19, 2022 | Dec 23, 2021 |
| Rocky_linux | — | Upgrade gegl04-debugsourceUpgrade gegl04-develUpgrade gegl04Upgrade gegl04-debuginfo | Mar 12, 2024 | Dec 23, 2021 |
| Suse | — | Upgrade libgegl-0_2-0Upgrade geglUpgrade gegl-0_4-langUpgrade libgegl-0_3-0Upgrade typelib-1_0-Gegl-0_3Upgrade gegl-develUpgrade gegl-0_4Upgrade gegl-0_3-langUpgrade gegl-docUpgrade gegl-0_3Upgrade typelib-1_0-Gegl-0_4Upgrade libgegl-0_4-0-32bitUpgrade libgegl-0_4-0Upgrade gegl-0_2-langUpgrade gegl-0_2 | Dec 29, 2021 | Dec 23, 2021 |
| Ubuntu | — | Upgrade gegl (Ubuntu Pro)Upgrade libgegl-0.3-0 (Ubuntu Pro)Upgrade libgegl-0.2-0 (Ubuntu Pro)Upgrade libgegl-0.4-0 (Ubuntu Pro) | Mar 22, 2023 | Dec 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub