Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files.

From Red Hat Security Advisory 2007:0513 :

Updated gimp packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Users of The GIMP should update to these erratum packages, which contain a backported fix to correct these issues.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files. (CVE-2006-4519)

Sean Larsson discovered multiple integer overflows in Gimp. By tricking a user into opening a specially crafted DICOM, PNM, PSD, PSP, RAS, XBM, or XWD image, a remote attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files (CVE-2006-4519).

Updated gimp packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Users of The GIMP should update to these erratum packages, which contain a backported fix to correct these issues.

Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files. (CVE-2006-4519)

Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value. (CVE-2007-2949)

Victor Stinner has discovered several flaws in file plug-ins using his fuzzyfier tool fusil. Several modified image files cause the plug-ins to crash or consume excessive amounts of memory due to insufficient input validation. Affected plug-ins: bmp, pcx, psd, psp (*.tub).
(CVE-2007-3741)

Updated packages have been patched to prevent these issues.

The remote host is affected by the vulnerability described in GLSA-200707-09 (GIMP: Multiple integer overflows)

    Sean Larsson from iDefense Labs discovered multiple integer overflows     in various GIMP plugins (CVE-2006-4519). Stefan Cornelius from Secunia     Research discovered an integer overflow in the     seek_to_and_unpack_pixeldata() function when processing PSD files     (CVE-2007-2949).
  Impact :

    A remote attacker could entice a user to open a specially crafted image     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running GIMP.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in Gimp, the GNU Image Manipulation Program, which might lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4519     Sean Larsson discovered several integer overflows in the     processing code for DICOM, PNM, PSD, RAS, XBM and XWD     images, which might lead to the execution of arbitrary     code if a user is tricked into opening such a malformed     media file.

  - CVE-2007-2949     Stefan Cornelius discovered an integer overflow in the     processing code for PSD images, which might lead to the     execution of arbitrary code if a user is tricked into     opening such a malformed media file.

ID	Name	Product	Family	Severity
67527	Oracle Linux 3 / 4 / 5 : gimp (ELSA-2007-0513)	Nessus	Oracle Linux Local Security Checks	medium
60256	Scientific Linux Security Update : gimp on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29444	SuSE 10 Security Update : gimp (ZYPP Patch Number 3993)	Nessus	SuSE Local Security Checks	medium
28096	Ubuntu 6.06 LTS / 6.10 / 7.04 : gimp vulnerability (USN-494-1)	Nessus	Ubuntu Local Security Checks	medium
27237	openSUSE 10 Security Update : gimp (gimp-3995)	Nessus	SuSE Local Security Checks	medium
26203	CentOS 3 / 4 / 5 : gimp (CESA-2007:0513)	Nessus	CentOS Local Security Checks	medium
26189	RHEL 2.1 / 3 / 4 / 5 : gimp (RHSA-2007:0513)	Nessus	Red Hat Local Security Checks	medium
25947	Mandrake Linux Security Advisory : gimp (MDKSA-2007:170)	Nessus	Mandriva Local Security Checks	medium
25791	GLSA-200707-09 : GIMP: Multiple integer overflows	Nessus	Gentoo Local Security Checks	medium
25744	Debian DSA-1335-1 : gimp - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2006-4519

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium