CVE-2021-45463

Katalog CVE

CVSS 7.8 · High EPSS 1,4%

Kerentanan pada gegl, gimp +2 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Rincian

Terbit di NVD

23 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 72,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.gnome.org/GNOME/gegl/-/issues/298 advisory vendor
• https://www.gimp.org/news/2021/12/21/gimp-2-10-30-released/ release notes · advisory vendor
• https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b patch · advisory pihak ketiga
• https://gitlab.gnome.org/GNOME/gimp/-/commit/e8a31ba4f2ce7e6bc34882dc27c97fba993f5868 patch · advisory pihak ketiga
• https://gitlab.gnome.org/GNOME/gegl/-/blob/master/docs/NEWS.adoc release notes · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG635WJCNXHJM...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP5NDNOTMPI33...
• https://lists.debian.org/debian-lts-announce/2025/10/msg00021.html