Hanno B&ouml;ck found several buffer overflows in GIMP, the GNU Image Manipulation Program, which could lead to application crash or other unspecified behaviour if a user opened untrusted input files.

For Debian 7 'Wheezy', these problems have been fixed in version 2.8.2-2+deb7u3.

We recommend that you upgrade your gimp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gimp: Heap-based buffer overflow in read_channel_data function in plug-ins/common/file-psp.c     (CVE-2017-17789)

  - Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote     attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted     XCF file. (CVE-2016-4994)

  - In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the     gbr import parser, related to mishandling of UTF-8 data. (CVE-2017-17784)

  - In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-     fli/fli.c. (CVE-2017-17785)

  - In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related     to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image. (CVE-2017-17786)

  - In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-     psp.c. (CVE-2017-17787)

  - In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is     no '\0' character after the version string. (CVE-2017-17788)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the gimp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In GIMP 2.8.22, there is a heap-based buffer over-read     in load_image in plug-ins/common/file-gbr.c in the gbr     import parser, related to mishandling of UTF-8     data.(CVE-2017-17784)

  - In GIMP 2.8.22, there is a heap-based buffer overflow     in the fli_read_brun function in     plug-ins/file-fli/fli.c.(CVE-2017-17785)

  - In GIMP 2.8.22, there is a heap-based buffer over-read     in ReadImage in plug-ins/common/file-tga.c (related to     bgr2rgb.part.1) via an unexpected bits-per-pixel value     for an RGBA image.(CVE-2017-17786)

  - In GIMP 2.8.22, there is a heap-based buffer over-read     in read_creator_block in     plug-ins/common/file-psp.c.(CVE-2017-1778)

  - In GIMP 2.8.22, there is a stack-based buffer over-read     in xcf_load_stream in app/xcf/xcf.c when there is no     '\\0' character after the version     string.(CVE-2017-17788)

  - In GIMP 2.8.22, there is a heap-based buffer overflow     in read_channel_data in     plug-ins/common/file-psp.c.(CVE-2017-17789)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that GIMP incorrectly handled certain images. If a user were tricked into opening a specially crafted image, an attacker could possibly use this to execute arbitrary code. (CVE-2017-17784, CVE-2017-17785, CVE-2017-17786, CVE-2017-17787, CVE-2017-17788, CVE-2017-17789).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-17784 CVE-2017-17785 CVE-2017-17786 CVE-2017-17787 CVE-2017-17788 CVE-2017-17789

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gimp: Heap-based buffer overflow in read_channel_data function in plug-ins/common/file-psp.c     (CVE-2017-17789)

  - Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote     attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted     XCF file. (CVE-2016-4994)

  - In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the     gbr import parser, related to mishandling of UTF-8 data. (CVE-2017-17784)

  - In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-     fli/fli.c. (CVE-2017-17785)

  - In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related     to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image. (CVE-2017-17786)

  - In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-     psp.c. (CVE-2017-17787)

  - In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is     no '\0' character after the version string. (CVE-2017-17788)

  - GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will     allocate for a huge amount of memory, resulting in insufficient memory or program crash. (CVE-2022-30067)

  - An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled     exception via a crafted XCF file, causing a Denial of Service (DoS). (CVE-2022-32990)

  - GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability     allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is     required to exploit this vulnerability in that the target must visit a malicious page or open a malicious     file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper     validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can     leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-     CAN-22094. (CVE-2023-44442)

  - GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote     attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to     exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The     specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one     error when calculating a location to write within a heap-based buffer. An attacker can leverage this     vulnerability to execute code in the context of the current process. Was ZDI-CAN-22097. (CVE-2023-44444)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service (application crash) or potentially the execution of arbitrary code if malformed files are opened.

This update for gimp fixes the following issues :

Security issue fixed :

  - CVE-2017-17787: Fixed an out-of-bounds read in the PSP     importer (bsc#1073628).

Non-security issue fixed :

  - Fixed a software crash while importing a _PostScript_     file (bsc#1178726).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
105427	Debian DLA-1220-1 : gimp security update	Nessus	Debian Local Security Checks	12/26/2017	1/11/2021	high
195577	RHEL 5 : gimp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
106164	EulerOS 2.0 SP2 : gimp (EulerOS-SA-2018-1023)	Nessus	Huawei Local Security Checks	1/19/2018	1/6/2021	high
106267	Ubuntu 14.04 LTS : GIMP vulnerabilities (USN-3539-1)	Nessus	Ubuntu Local Security Checks	1/23/2018	10/20/2023	high
106030	Fedora 27 : 2:gimp (2018-67b75f73fa)	Nessus	Fedora Local Security Checks	1/15/2018	1/6/2021	high
195523	RHEL 6 : gimp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
106163	EulerOS 2.0 SP1 : gimp (EulerOS-SA-2018-1022)	Nessus	Huawei Local Security Checks	1/19/2018	1/6/2021	high
105499	Debian DSA-4077-1 : gimp - security update	Nessus	Debian Local Security Checks	1/2/2018	1/4/2021	high
145400	openSUSE Security Update : gimp (openSUSE-2020-2357)	Nessus	SuSE Local Security Checks	1/25/2021	1/26/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high