The (1) psp (aka .tub), (2) bmp, (3) pcx, and (4) psd plugins in gimp allow user-assisted remote attackers to cause a denial of service (crash or memory consumption) via crafted image files, as discovered using the fusil fuzzing tool.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0513 advisory.

    [1.2.3-20.9.el3]
     - validate bytesperline header field when loading PCX files (#247570)

     [1.2.3-20.8.el3]
     - reduce GIMP_MAX_IMAGE_SIZE to 2^18 to detect bogus image widths/heights        (#247570)

     [1.2.3-20.7.el3]
     - replace gimp_error() by gimp_message()/gimp_quit() in a few plugins so      they        don't crash but gracefully exit when encountering error conditions
     - fix endianness issues in the PSP plugin to avoid it doing (seemingly)      endless        loops when loading images
     - fix endianness issues in the PCX plugin which cause it to not detect      corrupt        images

     [1.2.3-20.6.el3]
     - add ChangeLog entry to psd-invalid-dimensions patch (#247570)
     - validate size values read from files before using them to allocate      memory in        various file plugins (#247570, patch by Mukund Sivaraman and Rapha??l      Quinet,        adapted)
     - detect invalid image data when reading files in several plugins (#247570,        patch by Sven Neumann and Rapha??l Quinet, adapted)
     - validate size values read from files before using them to allocate      memory in        the PSD and sunras plugins (#247570, patch by Mukund Sivaraman and Sven        Neumann, partly adapted)
     - add safeguard to avoid crashes while loading corrupt PSD images (#247570,        patch by Rapha??l Quinet, adapted)
     - convert spec file to UTF-8

     [1.2.3-20.5.el3]
     - use adapted upstream PSD fix by Sven Neumann (#244406)

     [1.2.3-20.4.el3]
     - refuse to open PSD files with insanely large dimensions (#244406)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Updated gimp packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Users of The GIMP should update to these erratum packages, which contain a backported fix to correct these issues.

Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files. (CVE-2006-4519)

Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value. (CVE-2007-2949)

Victor Stinner has discovered several flaws in file plug-ins using his fuzzyfier tool fusil. Several modified image files cause the plug-ins to crash or consume excessive amounts of memory due to insufficient input validation. Affected plug-ins: bmp, pcx, psd, psp (*.tub).
(CVE-2007-3741)

Updated packages have been patched to prevent these issues.

ID	Name	Product	Family	Severity
67527	Oracle Linux 5 : Moderate: / gimp (ELSA-2007-0513)	Nessus	Oracle Linux Local Security Checks	medium
60256	Scientific Linux Security Update : gimp on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
26203	CentOS 3 / 4 / 5 : gimp (CESA-2007:0513)	Nessus	CentOS Local Security Checks	medium
26189	RHEL 2.1 / 3 / 4 / 5 : gimp (RHSA-2007:0513)	Nessus	Red Hat Local Security Checks	medium
25947	Mandrake Linux Security Advisory : gimp (MDKSA-2007:170)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-3741

medium

Tenable Plugins

medium

medium

medium

medium

medium