load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gegl | Gegl | * | 0.4.34 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | gegl-0:0.2.0-19.el7_9.1 | * |
| Red Hat Enterprise Linux 8 | RedHat | gegl04-0:0.4.4-6.el8_5.2 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | gegl04-0:0.4.4-6.el8_2.1 | * |
| Red Hat Enterprise Linux 8.4 Extended Update Support | RedHat | gegl04-0:0.4.4-6.el8_4.1 | * |
| Gegl | Ubuntu | bionic | * |
| Gegl | Ubuntu | devel | * |
| Gegl | Ubuntu | esm-apps/bionic | * |
| Gegl | Ubuntu | esm-apps/focal | * |
| Gegl | Ubuntu | esm-apps/jammy | * |
| Gegl | Ubuntu | esm-apps/noble | * |
| Gegl | Ubuntu | esm-apps/xenial | * |
| Gegl | Ubuntu | focal | * |
| Gegl | Ubuntu | hirsute | * |
| Gegl | Ubuntu | impish | * |
| Gegl | Ubuntu | jammy | * |
| Gegl | Ubuntu | kinetic | * |
| Gegl | Ubuntu | lunar | * |
| Gegl | Ubuntu | mantic | * |
| Gegl | Ubuntu | noble | * |
| Gegl | Ubuntu | oracular | * |
| Gegl | Ubuntu | plucky | * |
| Gegl | Ubuntu | trusty | * |
| Gegl | Ubuntu | trusty/esm | * |
| Gegl | Ubuntu | upstream | * |
| Gegl | Ubuntu | xenial | * |
References
- https://gitlab.gnome.org/GNOME/gegl/-/blob/master/docs/NEWS.adoc
- https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b
- https://gitlab.gnome.org/GNOME/gegl/-/issues/298
- https://gitlab.gnome.org/GNOME/gimp/-/commit/e8a31ba4f2ce7e6bc34882dc27c97fba993f5868
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG635WJCNXHJM5U4BGMAAP4NK2YFTQXK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP5NDNOTMPI335FXE7VUPW7FXYTT7PYN/
- https://www.gimp.org/news/2021/12/21/gimp-2-10-30-released/
- https://gitlab.gnome.org/GNOME/gegl/-/blob/master/docs/NEWS.adoc
- https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b
- https://gitlab.gnome.org/GNOME/gegl/-/issues/298
- https://gitlab.gnome.org/GNOME/gimp/-/commit/e8a31ba4f2ce7e6bc34882dc27c97fba993f5868
- https://lists.debian.org/debian-lts-announce/2025/10/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG635WJCNXHJM5U4BGMAAP4NK2YFTQXK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZP5NDNOTMPI335FXE7VUPW7FXYTT7PYN/
- https://www.gimp.org/news/2021/12/21/gimp-2-10-30-released/