[Bug 1953616] New: CVE-2021-22204 perl-Image-ExifTool: improper neutralization of user data in the DjVu file format allows arbitrary code execution when parsing the malicious image

https://bugzilla.redhat.com/show_bug.cgi?id=1953616

            Bug ID: 1953616
           Summary: CVE-2021-22204 perl-Image-ExifTool: improper
                    neutralization of user data in the DjVu file format
                    allows arbitrary code execution when parsing the
                    malicious image
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: gsuckevi(a)redhat.com
                CC: perl-devel(a)lists.fedoraproject.org, spotrh(a)gmail.com
  Target Milestone: ---
    Classification: Other



Improper neutralization of user data in the DjVu file format in ExifTool
versions 7.44 and up allows arbitrary code execution when parsing the malicious
image

Reference and upstream patch:
https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a8...


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1953616] CVE-2021-22204 perl-Image-ExifTool: improper neutralization of user data in the DjVu file format allows arbitrary code execution when parsing the malicious image

https://bugzilla.redhat.com/show_bug.cgi?id=1953616

Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1953617





Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1953617
[Bug 1953617] CVE-2021-22204 perl-Image-ExifTool: improper neutralization of
user data in the DjVu file format allows arbitrary code execution when parsing
the malicious image [fedora-all]
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1953616] CVE-2021-22204 perl-Image-ExifTool: improper neutralization of user data in the DjVu file format allows arbitrary code execution when parsing a malicious image

https://bugzilla.redhat.com/show_bug.cgi?id=1953616

Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|CVE-2021-22204              |CVE-2021-22204
                   |perl-Image-ExifTool:        |perl-Image-ExifTool:
                   |improper neutralization of  |improper neutralization of
                   |user data in the DjVu file  |user data in the DjVu file
                   |format allows arbitrary     |format allows arbitrary
                   |code execution when parsing |code execution when parsing
                   |the malicious image         |a malicious image



--- Comment #1 from Guilherme de Almeida Suckevicz <gsuckevi(a)redhat.com&gt; ---
Created perl-Image-ExifTool tracking bugs for this issue:

Affects: fedora-all [bug 1953617]


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1953616] CVE-2021-22204 perl-Image-ExifTool: improper neutralization of user data in the DjVu file format allows arbitrary code execution when parsing a malicious image

https://bugzilla.redhat.com/show_bug.cgi?id=1953616

Product Security DevOps Team <prodsec-dev(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |UPSTREAM
        Last Closed|                            |2021-04-26 16:46:35



--- Comment #2 from Product Security DevOps Team <prodsec-dev(a)redhat.com&gt; ---
This CVE Bugzilla entry is for community support informational purposes only as
it does not affect a package in a commercially supported Red Hat product. Refer
to the dependent bugs for status of those individual community products.


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1953616] CVE-2021-22204 perl-Image-ExifTool: improper neutralization of user data in the DjVu file format allows arbitrary code execution when parsing a malicious image

https://bugzilla.redhat.com/show_bug.cgi?id=1953616
Bug 1953616 depends on bug 1953617, which changed state.

Bug 1953617 Summary: CVE-2021-22204 perl-Image-ExifTool: improper neutralization of user
data in the DjVu file format allows arbitrary code execution when parsing a malicious
image [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1953617

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA




-- 
You are receiving this mail because:
You are on the CC list for the bug.