Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0513 advisory.

    [1.2.3-20.9.el3]
     - validate bytesperline header field when loading PCX files (#247570)

     [1.2.3-20.8.el3]
     - reduce GIMP_MAX_IMAGE_SIZE to 2^18 to detect bogus image widths/heights        (#247570)

     [1.2.3-20.7.el3]
     - replace gimp_error() by gimp_message()/gimp_quit() in a few plugins so      they        don't crash but gracefully exit when encountering error conditions
     - fix endianness issues in the PSP plugin to avoid it doing (seemingly)      endless        loops when loading images
     - fix endianness issues in the PCX plugin which cause it to not detect      corrupt        images

     [1.2.3-20.6.el3]
     - add ChangeLog entry to psd-invalid-dimensions patch (#247570)
     - validate size values read from files before using them to allocate      memory in        various file plugins (#247570, patch by Mukund Sivaraman and Rapha??l      Quinet,        adapted)
     - detect invalid image data when reading files in several plugins (#247570,        patch by Sven Neumann and Rapha??l Quinet, adapted)
     - validate size values read from files before using them to allocate      memory in        the PSD and sunras plugins (#247570, patch by Mukund Sivaraman and Sven        Neumann, partly adapted)
     - add safeguard to avoid crashes while loading corrupt PSD images (#247570,        patch by Rapha??l Quinet, adapted)
     - convert spec file to UTF-8

     [1.2.3-20.5.el3]
     - use adapted upstream PSD fix by Sven Neumann (#244406)

     [1.2.3-20.4.el3]
     - refuse to open PSD files with insanely large dimensions (#244406)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files. (CVE-2006-4519)

Sean Larsson discovered multiple integer overflows in Gimp. By tricking a user into opening a specially crafted DICOM, PNM, PSD, PSP, RAS, XBM, or XWD image, a remote attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple gimp import filters contained integer overflows. Attackers could exploit that to potentially execute code by tricking users into opening specially crafted files (CVE-2006-4519).

Updated gimp packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow and input validation flaws were found in The GIMP's image loaders. An attacker could create a carefully crafted image file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2006-4519, CVE-2007-2949, CVE-2007-3741)

Users of The GIMP should update to these erratum packages, which contain a backported fix to correct these issues.

Multiple integer overflows in the image loader plug-ins in GIMP before 2.2.16 allow user-assisted remote attackers to execute arbitrary code via crafted length values in (1) DICOM, (2) PNM, (3) PSD, (4) PSP, (5) Sun RAS, (6) XBM, and (7) XWD files. (CVE-2006-4519)

Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value. (CVE-2007-2949)

Victor Stinner has discovered several flaws in file plug-ins using his fuzzyfier tool fusil. Several modified image files cause the plug-ins to crash or consume excessive amounts of memory due to insufficient input validation. Affected plug-ins: bmp, pcx, psd, psp (*.tub).
(CVE-2007-3741)

Updated packages have been patched to prevent these issues.

The remote host is affected by the vulnerability described in GLSA-200707-09 (GIMP: Multiple integer overflows)

    Sean Larsson from iDefense Labs discovered multiple integer overflows     in various GIMP plugins (CVE-2006-4519). Stefan Cornelius from Secunia     Research discovered an integer overflow in the     seek_to_and_unpack_pixeldata() function when processing PSD files     (CVE-2007-2949).
  Impact :

    A remote attacker could entice a user to open a specially crafted image     file, possibly resulting in the execution of arbitrary code with the     privileges of the user running GIMP.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in Gimp, the GNU Image Manipulation Program, which might lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4519     Sean Larsson discovered several integer overflows in the     processing code for DICOM, PNM, PSD, RAS, XBM and XWD     images, which might lead to the execution of arbitrary     code if a user is tricked into opening such a malformed     media file.

  - CVE-2007-2949     Stefan Cornelius discovered an integer overflow in the     processing code for PSD images, which might lead to the     execution of arbitrary code if a user is tricked into     opening such a malformed media file.

ID	Name	Product	Family	Severity
67527	Oracle Linux 5 : Moderate: / gimp (ELSA-2007-0513)	Nessus	Oracle Linux Local Security Checks	medium
60256	Scientific Linux Security Update : gimp on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29444	SuSE 10 Security Update : gimp (ZYPP Patch Number 3993)	Nessus	SuSE Local Security Checks	medium
28096	Ubuntu 6.06 LTS / 6.10 / 7.04 : gimp vulnerability (USN-494-1)	Nessus	Ubuntu Local Security Checks	medium
27237	openSUSE 10 Security Update : gimp (gimp-3995)	Nessus	SuSE Local Security Checks	medium
26203	CentOS 3 / 4 / 5 : gimp (CESA-2007:0513)	Nessus	CentOS Local Security Checks	medium
26189	RHEL 2.1 / 3 / 4 / 5 : gimp (RHSA-2007:0513)	Nessus	Red Hat Local Security Checks	medium
25947	Mandrake Linux Security Advisory : gimp (MDKSA-2007:170)	Nessus	Mandriva Local Security Checks	medium
25791	GLSA-200707-09 : GIMP: Multiple integer overflows	Nessus	Gentoo Local Security Checks	medium
25744	Debian DSA-1335-1 : gimp - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2006-4519

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium