Description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ExifTool ExifTool
>=7.44, <12.24affected
References
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 ↗
- https://hackerone.com/reports/1154542 ↗
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json ↗
- https://www.debian.org/security/2021/dsa-4910 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ ↗
- http://www.openwall.com/lists/oss-security/2021/05/09/1 ↗
- http://www.openwall.com/lists/oss-security/2021/05/10/5 ↗
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html ↗
- https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html ↗
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html ↗
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html ↗
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204 ↗