Lucene search

K

GoogleOSV:CVE-2021-22204

HistoryApr 23, 2021 - 6:15 p.m.

CVE-2021-22204

2021-04-2318:15:08

Google

osv.dev

3

7.5 High

AI Score

Confidence

Low

0.89 High

EPSS

Percentile

98.8%

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CPENameOperatorVersion
exiftooleq11.12
exiftooleq10.42
exiftooleq12.07
exiftooleq11.51
exiftooleq10.16
exiftooleq10.07
exiftooleq10.05
exiftooleq10.08
exiftooleq10.77
exiftooleq11.04

Rows per page:

1-10 of 2521

References

packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html

packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html

packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html

packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html

www.openwall.com/lists/oss-security/2021/05/09/1

www.openwall.com/lists/oss-security/2021/05/10/5

github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json

hackerone.com/reports/1154542

lists.debian.org/debian-lts-announce/2021/05/msg00018.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/

www.debian.org/security/2021/dsa-4910

7.5 High

AI Score

Confidence

Low

0.89 High

EPSS

Percentile

98.8%