Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and     earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a     command to the script-fu server. (CVE-2012-2763)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Solaris system is missing necessary patches to address security updates :

  - Buffer overflow in the readstr_upto function in     plug-ins/script-fu/tinyscheme/ scheme.c in GIMP 2.6.12     and earlier, and possibly 2.6.13, allows remote     attackers to execute arbitrary code via a long string in     a command to the script-fu server. (CVE-2012-2763)

Fixed 2 gimp security bugs :

  - fixed bnc#724628 CVE-2012-3481: gimp: GIF plugin     'height' / 'len' integer overflow leading to heap-based     buffer overflow

  - fixed bnc#763595 CVE-2012-2763: gimp: buffer overflow in     script-fu's server component

Multiple integer overflows in various decoder plug-ins of GIMP have been fixed.

This update of Gimp fixed a remotely exploitable buffer overflow in Script-Fu's server component as well as a NULL pointer dereference flaw in the fit format handler.

The remote host is affected by the vulnerability described in GLSA-201209-23 (GIMP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GIMP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
217653	Linux Distros Unpatched Vulnerability : CVE-2012-2763	Nessus	Misc.	critical
80619	Oracle Solaris Third-Party Patch Update : gimp (cve_2012_2763_buffer_overflow)	Nessus	Solaris Local Security Checks	high
74745	openSUSE Security Update : gimp (openSUSE-SU-2012:1131-1)	Nessus	SuSE Local Security Checks	high
74735	openSUSE Security Update : gimp (openSUSE-SU-2012:1080-1)	Nessus	SuSE Local Security Checks	high
64147	SuSE 11.1 Security Update : Gimp (SAT Patch Number 6542)	Nessus	SuSE Local Security Checks	high
62379	GLSA-201209-23 : GIMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2012-2763

critical

Tenable Plugins

critical

high

high

high

high

high