[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAPWJUnz=mf9+zHrrxgBYYZdQzDW-zKf0kCOeVY4y-61CeA9HPg@mail.gmail.com>
Date: Sun, 9 May 2021 14:32:25 +1000
From: William Bowling <will@...wling.info>
To: oss-security@...ts.openwall.com
Subject: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu
module when parsing a malicious image
ExifTool 7.44 to 12.23 has a bug in the DjVu module which allows for
arbitrary code execution when parsing malicious images. The bug can be
triggered from a wide variety of valid file formats.
The bug has been fixed in version 12.24.
References:
Fixed release - https://exiftool.org/history.html#v12.24
Upstream patch -
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800
CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204
--
GPG Key ID: 0x980F711A
GPG Key Fingerprint: AA38 2A0E 7D22 18A9 6086 0289 41DC E04B 980F 711A
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
