Date: Sun, 9 May 2021 14:32:25 +1000 From: William Bowling <will@...wling.info> To: oss-security@...ts.openwall.com Subject: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image ExifTool 7.44 to 12.23 has a bug in the DjVu module which allows for arbitrary code execution when parsing malicious images. The bug can be triggered from a wide variety of valid file formats. The bug has been fixed in version 12.24. References: Fixed release - https://exiftool.org/history.html#v12.24 Upstream patch - https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 CVE - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22204 -- GPG Key ID: 0x980F711A GPG Key Fingerprint: AA38 2A0E 7D22 18A9 6086 0289 41DC E04B 980F 711A
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.