Buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.

GNOME 2.6.0_x86: GNOME Desktop Patch.
Date this patch was last updated by Sun : Nov/10/12

GNOME 2.6.0: GNOME Desktop Patch.
Date this patch was last updated by Sun : Nov/10/12

A buffer overflow was fixed in the xcf loader in GIMP that allows user-complicit attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property. (CVE-2006-3404)

Henning Makholm discovered that gimp did not sufficiently validate the 'num_axes' parameter in XCF files. By tricking a user into opening a specially crafted XCF file with Gimp, an attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp 2.2.x allows user-complicit attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.

Updated packages have been patched to correct this issue.

Henning Makholm discovered a buffer overflow in the XCF loading code of Gimp, an image editing program. Opening a specially crafted XCF image might cause the application to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200607-08 (GIMP: Buffer overflow)

    Henning Makholm discovered that the 'xcf_load_vector()' function is     vulnerable to a buffer overflow when loading a XCF file with a large     'num_axes' value.
  Impact :

    An attacker could exploit this issue to execute arbitrary code by     enticing a user to open a specially crafted XCF file.
  Workaround :

    There is no known workaround at this time.

New gimp packages are available for Slackware 10.2 and -current to fix a possible security issue.

Updated gimp packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Henning Makholm discovered a buffer overflow bug in The GIMP XCF file loader. An attacker could create a carefully crafted image that could execute arbitrary code if opened by a victim. (CVE-2006-3404)

Please note that this issue did not affect the gimp packages in Red Hat Enterprise Linux 2.1, or 3.

Users of The GIMP should update to these erratum packages which contain a backported fix to correct this issue.

ID	Name	Product	Family	Severity
107880	Solaris 10 (x86) : 122213-46	Nessus	Solaris Local Security Checks	medium
107378	Solaris 10 (sparc) : 122212-46	Nessus	Solaris Local Security Checks	medium
29441	SuSE 10 Security Update : gimp (ZYPP Patch Number 1920)	Nessus	SuSE Local Security Checks	medium
27887	Ubuntu 5.04 / 5.10 / 6.06 LTS : gimp vulnerability (USN-312-1)	Nessus	Ubuntu Local Security Checks	medium
27238	openSUSE 10 Security Update : gimp-unstable (gimp-unstable-1919)	Nessus	SuSE Local Security Checks	medium
27234	openSUSE 10 Security Update : gimp (gimp-1921)	Nessus	SuSE Local Security Checks	medium
23878	Mandrake Linux Security Advisory : gimp (MDKSA-2006:127)	Nessus	Mandriva Local Security Checks	medium
22658	Debian DSA-1116-1 : gimp - buffer overflow	Nessus	Debian Local Security Checks	medium
22106	GLSA-200607-08 : GIMP: Buffer overflow	Nessus	Gentoo Local Security Checks	medium
22100	Slackware 10.2 / current : gimp (SSA:2006-207-03)	Nessus	Slackware Local Security Checks	medium
22071	RHEL 4 : gimp (RHSA-2006:0598)	Nessus	Red Hat Local Security Checks	medium
22067	CentOS 4 : gimp (CESA-2006:0598)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2006-3404

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium