PT-2020-7901 · Gm · Gm

Published 2020-09-01 · Updated 2020-09-01 · CVE-2015-7982

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: gm versions prior to 1.21.1

Description: The issue is triggered when user input is passed into the gm.compare() function, which fails to sanitize input correctly before calling the graphics magic binary. This leads to a command injection vulnerability.

Recommendations: Update to version 1.21.1 or later.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2015-7982

GHSA-PJH3-JV7W-9JPR

Affected Products

Gm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-7982 · Security Note
• https://osv.dev/vulnerability/GHSA-pjh3-jv7w-9jpr · Vendor Advisory
• https://github.com/aheckmann/gm · Note
• https://github.com/aheckmann/gm/commit/5f5c77490aa84ed313405c88905eb4566135be31 · Note
• https://npmjs.com/advisories/54 · Note