OS Command Injection In gegl
Description
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 1:0.4.34-1 | ||
debian 11 | 1:0.4.26-2+deb11u1 | ||
debian 12 | 1:0.4.34-1 | ||
debian 14 | 1:0.4.34-1 | ||
 rpm rhel8 | - | - | |
rpm rhel7 | 0:0.2.0-19.el7_9.1 | ||
rpm rhel8.4 | 0:0.4.4-6.el8_4.1 | ||
rpm rhel8 | 0:0.4.4-6.el8_5.2 | ||
rpm rhel6 | - | - | |
rpm rhel8.2 | 0:0.4.4-6.el8_2.1 |
Aliases
1. 2. 3. 4. 5.