PT-2021-6874 · Gnu+12 · Gegl+13
Published
2021-12-15
·
Updated
2025-10-22
·
CVE-2021-45463
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GIMP versions prior to 2.10.30
GEGL versions prior to 0.4.34
Description
The issue is related to the
load cache function in GEGL, which is used by GIMP. It allows shell expansion when a pathname in a constructed command line is not escaped or filtered, due to the use of the system library function for execution of the ImageMagick convert fallback in magick-load. This can be exploited by a remote attacker to execute arbitrary commands on the target system by passing special data to the application.Recommendations
For GEGL versions prior to 0.4.34, update to version 0.4.34 or later to resolve the issue.
For GIMP versions prior to 2.10.30, update to version 2.10.30 or later to resolve the issue.
As a temporary workaround, consider disabling the
magick-load feature in GEGL until a patch is available.
Restrict access to the load cache function to minimize the risk of exploitation.Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Gegl
Gimp
Imagemagick
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu