load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-gegl04alma-upgrade-gegl04-devel | May 4, 2022 | Dec 23, 2021 | |
| Alpine Linux | alpine-linux-upgrade-gegl | Aug 22, 2024 | Dec 23, 2021 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-geglamazon-linux-ami-2-upgrade-gegl-debuginfoamazon-linux-ami-2-upgrade-gegl-devel | Jul 4, 2022 | Dec 23, 2021 | |
| Centos_linux | — | centos-upgrade-geglcentos-upgrade-gegl-debuginfocentos-upgrade-gegl-develcentos-upgrade-gegl04centos-upgrade-gegl04-debuginfocentos-upgrade-gegl04-debugsourcecentos-upgrade-gegl04-tools-debuginfo | Feb 17, 2022 | Dec 23, 2021 |
| Debian | debian-upgrade-gegl | Jul 30, 2024 | Dec 23, 2021 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-gegl | May 25, 2022 | Dec 23, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-gegl | Mar 22, 2022 | Dec 23, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-gegl04 | Mar 29, 2022 | Dec 23, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-gegloracle-linux-upgrade-gegl04oracle-linux-upgrade-gegl04-develoracle-linux-upgrade-gegl-devel | Jan 19, 2022 | Dec 15, 2021 |
| Redhat_linux | redhat-upgrade-geglredhat-upgrade-gegl-debuginforedhat-upgrade-gegl-develredhat-upgrade-gegl04redhat-upgrade-gegl04-debuginforedhat-upgrade-gegl04-debugsourceredhat-upgrade-gegl04-develredhat-upgrade-gegl04-tools-debuginfo | Jan 19, 2022 | Dec 23, 2021 | |
| Rocky_linux | rocky-upgrade-gegl04rocky-upgrade-gegl04-debuginforocky-upgrade-gegl04-debugsourcerocky-upgrade-gegl04-devel | Mar 12, 2024 | Dec 23, 2021 | |
| Suse | — | suse-upgrade-geglsuse-upgrade-gegl-0_2suse-upgrade-gegl-0_2-langsuse-upgrade-gegl-0_3suse-upgrade-gegl-0_3-langsuse-upgrade-gegl-0_4suse-upgrade-gegl-0_4-langsuse-upgrade-gegl-develsuse-upgrade-gegl-docsuse-upgrade-libgegl-0_2-0suse-upgrade-libgegl-0_3-0suse-upgrade-libgegl-0_4-0suse-upgrade-libgegl-0_4-0-32bitsuse-upgrade-typelib-1_0-gegl-0_3suse-upgrade-typelib-1_0-gegl-0_4 | Dec 29, 2021 | Dec 23, 2021 |
| Ubuntu | ubuntu-pro-upgrade-geglubuntu-pro-upgrade-libgegl-0-2-0ubuntu-pro-upgrade-libgegl-0-3-0ubuntu-pro-upgrade-libgegl-0-4-0 | Mar 22, 2023 | Dec 23, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub