Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - Gimp: Integer overflow in the PSD image file plugin (CVE-2009-3909)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1181 advisory.

    - fix overflow in GIF loader (CVE-2012-3481)
    - fix overflows in PSD plugin (CVE-2009-3909, CVE-2012-3402)
    - fix heap corruption and overflow in GIF plug-in (CVE-2011-2896)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201209-23 (GIMP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GIMP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the GIMP's Adobe Photoshop (PSD) image file plug-in. An attacker could create a specially crafted PSD image file that, when opened, could cause the PSD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-3909, CVE-2012-3402)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3481)

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2011-2896)

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3403)

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the GIMP's Adobe Photoshop (PSD) image file plug-in. An attacker could create a specially crafted PSD image file that, when opened, could cause the PSD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-3909, CVE-2012-3402)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3481)

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2011-2896)

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3403)

Red Hat would like to thank Secunia Research for reporting CVE-2009-3909, and Matthias Weckbecker of the SUSE Security Team for reporting CVE-2012-3481.

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

Integer overflows in the BMP and PSD plug-ins potentially allowed attackers to execute arbitrary code on the victim's system by tricking the victim to open specially crafted files. 

  - CVE-2009-3909: CVSS v2 Base Score: 4.3 (moderate)     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Numeric Errors. (CWE-189).
    (CVE-2009-1570: CVSS v2 Base Score: 4.3 (moderate)     (AV:N/AC:M/Au:N/C:N/I:N/A:P)). (- Numeric Errors     (CWE-189))

Integer overflows in the BMP and PSD plug-ins potentially allowed attackers to execute arbitrary code on the victim's system by tricking the victim to open specially crafted files.

  - CVE-2009-3909: CVSS v2 Base Score: 4.3 (moderate)     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Numeric Errors. (CWE-189).
    (CVE-2009-1570: CVSS v2 Base Score: 4.3 (moderate)     (AV:N/AC:M/Au:N/C:N/I:N/A:P)). (- Numeric Errors     (CWE-189))

Integer overflows in the BMP and PSD plug-ins potentially allowed attackers to execute arbitrary code on the victim's system by tricking the victim to open specially crafted files. (CVE-2009-1570 / CVE-2009-3909)

A vulnerability was discovered and corrected in gimp :

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow (CVE-2009-3909).

Additionally the patch for CVE-2009-1570 in MDVSA-2009:296 was incomplete, this update corrects this as well.

This update provides a solution to this vulnerability.

Update :

Packages for 2009.0 are provided due to the Extended Maintenance Program.

Integer overflows in the BMP and PSD plug-ins potentially allowed attackers to execute arbitrary code on the victim's system by tricking the victim to open specially crafted files (CVE-2009-1570, CVE-2009-3909). 

Gimp was updated to to version 2.6.8 which fixes those issues.

Integer overflows in the BMP and PSD plug-ins potentially allowed attackers to execute arbitrary code on the victim's system by tricking the victim to open specially crafted files (CVE-2009-1570, CVE-2009-3909).

Integer overflows in the BMP plug-in potentially allowed attackers to execute arbitrary code on the victim's system by tricking the victim to open specially crafted files (CVE-2009-1570).

Several integer overflows, buffer overflows and memory allocation errors were discovered in the Poppler PDF rendering library, which may lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed PDF document.

An update for the old stable distribution (etch) will be issued soon as version 0.4.5-5.1etch4.

Stefan Cornelius discovered that GIMP did not correctly handle certain malformed BMP files. If a user were tricked into opening a specially crafted BMP file, an attacker could execute arbitrary code with the user's privileges. (CVE-2009-1570)

Stefan Cornelius discovered that GIMP did not correctly handle certain malformed PSD files. If a user were tricked into opening a specially crafted PSD file, an attacker could execute arbitrary code with the user's privileges. This issue only applied to Ubuntu 8.10, 9.04 and 9.10. (CVE-2009-3909).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New gimp packages are available for Slackware 12.1, 12.2, 13.0, and
-current to fix security issues.

ID	Name	Product	Family	Severity
198327	RHEL 4 : gimp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
68601	Oracle Linux 5 : gimp (ELSA-2012-1181)	Nessus	Oracle Linux Local Security Checks	high
62379	GLSA-201209-23 : GIMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
61605	Scientific Linux Security Update : gimp on SL5.x i386/x86_64 (20120820)	Nessus	Scientific Linux Local Security Checks	high
61604	RHEL 5 : gimp (RHSA-2012:1181)	Nessus	Red Hat Local Security Checks	high
61600	CentOS 5 : gimp (CESA-2012:1181)	Nessus	CentOS Local Security Checks	high
51747	SuSE 10 Security Update : gimp (ZYPP Patch Number 6882)	Nessus	SuSE Local Security Checks	high
51746	SuSE 10 Security Update : gimp (ZYPP Patch Number 6880)	Nessus	SuSE Local Security Checks	high
50910	SuSE 11 Security Update : gimp (SAT Patch Number 2155)	Nessus	SuSE Local Security Checks	high
46175	Mandriva Linux Security Advisory : gimp (MDVSA-2009:332-1)	Nessus	Mandriva Local Security Checks	high
45537	openSUSE Security Update : gimp (openSUSE-SU-2010:0115-1)	Nessus	SuSE Local Security Checks	high
45535	openSUSE Security Update : gimp (openSUSE-SU-2010:0115-1)	Nessus	SuSE Local Security Checks	high
45532	openSUSE Security Update : gimp (openSUSE-SU-2010:0110-1)	Nessus	SuSE Local Security Checks	high
44806	Debian DSA-1941-1 : poppler - several vulnerabilities	Nessus	Debian Local Security Checks	high
43825	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : gimp vulnerabilities (USN-880-1)	Nessus	Ubuntu Local Security Checks	high
43112	Slackware 12.1 / 12.2 / 13.0 / current : gimp (SSA:2009-345-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2009-3909

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high