جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

• https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 x_refsource_MISC
• https://hackerone.com/reports/1154542 x_refsource_MISC
• https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json x_refsource_CONFIRM
• https://www.debian.org/security/2021/dsa-4910 vendor-advisoryx_refsource_DEBIAN
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ vendor-advisoryx_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ vendor-advisoryx_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ vendor-advisoryx_refsource_FEDORA
• http://www.openwall.com/lists/oss-security/2021/05/09/1 mailing-listx_refsource_MLIST
• http://www.openwall.com/lists/oss-security/2021/05/10/5 mailing-listx_refsource_MLIST
• http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html x_refsource_MISC
• https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html mailing-listx_refsource_MLIST
• http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html x_refsource_MISC
• http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html x_refsource_MISC
• http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html x_refsource_MISC
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204 government-resource