Several vulnerabilities have been identified in GIMP, the GNU Image Manipulation Program.

  - CVE-2010-4540     Stack-based buffer overflow in the load_preset_response     function in plug-ins/lighting/lighting-ui.c in the     'LIGHTING EFFECTS & LIGHT' plugin allows user-assisted     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a long 'Position' field in a plugin configuration     file.

  - CVE-2010-4541     Stack-based buffer overflow in the loadit function in     plug-ins/common/sphere-designer.c in the 'SPHERE     DESIGNER' plugin allows user-assisted remote attackers     to cause a denial of service (application crash) or     possibly execute arbitrary code via a long 'Number of     lights' field in a plugin configuration file.

  - CVE-2010-4542     Stack-based buffer overflow in the     gfig_read_parameter_gimp_rgb function in the GFIG plugin     allows user-assisted remote attackers to cause a denial     of service (application crash) or possibly execute     arbitrary code via a long 'Foreground' field in a plugin     configuration file.

  - CVE-2010-4543     Heap-based buffer overflow in the read_channel_data     function in file-psp.c in the Paint Shop Pro (PSP)     plugin allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a PSP_COMP_RLE (aka RLE compression)     image file that begins a long run count at the end of     the image.

  - CVE-2011-1782     The correction for CVE-2010-4543 was incomplete.

  - CVE-2011-2896     The LZW decompressor in the LZWReadByte function in     plug-ins/common/file-gif-load.c does not properly handle     code words that are absent from the decompression table     when encountered, which allows remote attackers to     trigger an infinite loop or a heap-based buffer     overflow, and possibly execute arbitrary code, via a     crafted compressed stream.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro (PSP) image file plug-in. An attacker could create a specially crafted PSP image file that, when opened, could cause the PSP plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4543)

A stack-based buffer overflow flaw was found in the GIMP's Lightning, Sphere Designer, and Gfig image filters. An attacker could create a specially crafted Lightning, Sphere Designer, or Gfig filter configuration file that, when opened, could cause the relevant plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4540, CVE-2010-4541, CVE-2010-4542)

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's Microsoft Windows Bitmap (BMP) and Personal Computer eXchange (PCX) image file plug-ins. An attacker could create a specially crafted BMP or PCX image file that, when opened, could cause the relevant plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-1570, CVE-2011-1178)

A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro (PSP) image file plug-in. An attacker could create a specially crafted PSP image file that, when opened, could cause the PSP plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4543)

A stack-based buffer overflow flaw was found in the GIMP's Lightning, Sphere Designer, and Gfig image filters. An attacker could create a specially crafted Lightning, Sphere Designer, or Gfig filter configuration file that, when opened, could cause the relevant plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4540, CVE-2010-4541, CVE-2010-4542)

Red Hat would like to thank Stefan Cornelius of Secunia Research for responsibly reporting the CVE-2009-1570 flaw.

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

From Red Hat Security Advisory 2011:0837 :

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's Microsoft Windows Bitmap (BMP) and Personal Computer eXchange (PCX) image file plug-ins. An attacker could create a specially crafted BMP or PCX image file that, when opened, could cause the relevant plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-1570, CVE-2011-1178)

A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro (PSP) image file plug-in. An attacker could create a specially crafted PSP image file that, when opened, could cause the PSP plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4543)

A stack-based buffer overflow flaw was found in the GIMP's Sphere Designer image filter. An attacker could create a specially crafted Sphere Designer filter configuration file that, when opened, could cause the Sphere Designer plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP.
(CVE-2010-4541)

Red Hat would like to thank Stefan Cornelius of Secunia Research for responsibly reporting the CVE-2009-1570 flaw.

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
58250	Debian DSA-2426-1 : gimp - several vulnerabilities	Nessus	Debian Local Security Checks	2012/3/7	2021/1/11	high
61058	Scientific Linux Security Update : gimp on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67082	CentOS 5 : gimp (CESA-2011:0838)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	high
68278	Oracle Linux 4 : gimp (ELSA-2011-0837)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high

检测

插件搜索

high

high

high

high