Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSP_COMP_RLE (aka RLE compression) image file that begins a long run count at the end of the image. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4543.

This update fixes various overflows :

  + CVE-2011-1178: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P)

  + CVE-2011-1782: CVSS v2 Base Score: 6.8     (AV:N/AC:M/Au:N/C:P/I:P/A:P)

Several vulnerabilities have been identified in GIMP, the GNU Image Manipulation Program.

  - CVE-2010-4540     Stack-based buffer overflow in the load_preset_response     function in plug-ins/lighting/lighting-ui.c in the     'LIGHTING EFFECTS & LIGHT' plugin allows user-assisted     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a long 'Position' field in a plugin configuration     file.

  - CVE-2010-4541     Stack-based buffer overflow in the loadit function in     plug-ins/common/sphere-designer.c in the 'SPHERE     DESIGNER' plugin allows user-assisted remote attackers     to cause a denial of service (application crash) or     possibly execute arbitrary code via a long 'Number of     lights' field in a plugin configuration file.

  - CVE-2010-4542     Stack-based buffer overflow in the     gfig_read_parameter_gimp_rgb function in the GFIG plugin     allows user-assisted remote attackers to cause a denial     of service (application crash) or possibly execute     arbitrary code via a long 'Foreground' field in a plugin     configuration file.

  - CVE-2010-4543     Heap-based buffer overflow in the read_channel_data     function in file-psp.c in the Paint Shop Pro (PSP)     plugin allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a PSP_COMP_RLE (aka RLE compression)     image file that begins a long run count at the end of     the image.

  - CVE-2011-1782     The correction for CVE-2010-4543 was incomplete.

  - CVE-2011-2896     The LZW decompressor in the LZWReadByte function in     plug-ins/common/file-gif-load.c does not properly handle     code words that are absent from the decompression table     when encountered, which allows remote attackers to     trigger an infinite loop or a heap-based buffer     overflow, and possibly execute arbitrary code, via a     crafted compressed stream.

A number of heap-based buffer overflows have been found in The Gimp affecting the PCX (CVE-2011-1178), SGI, GBR and PAT (CVE-2011-1782) plugins. The update fixes these security issues.

Nils Philippsen discovered that GIMP incorrectly handled malformed PSP image files. If a user were tricked into opening a specially crafted PSP image file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes buffer overflows in the PSP (CVE-2010-4543, CVE-2011-1782), sphere-designer (CVE-2010-4541), gfig (CVE-2010-4542) and lighting (CVE-2010-4540) plugins.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities was discovered and fixed in gimp :

Stack-based buffer overflow in the 'LIGHTING EFFECTS > LIGHT' plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long Position field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself (CVE-2010-4540).

Stack-based buffer overflow in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long Number of lights field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself (CVE-2010-4541).

Stack-based buffer overflow in the GFIG plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long Foreground field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself (CVE-2010-4542).

Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSP_COMP_RLE (aka RLE compression) image file that begins a long run count at the end of the image (CVE-2010-4543, CVE-2011-1782).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
75849	openSUSE Security Update : gimp (openSUSE-SU-2011:0586-1)	Nessus	SuSE Local Security Checks	high
75514	openSUSE Security Update : gimp (openSUSE-SU-2011:0586-1)	Nessus	SuSE Local Security Checks	high
58250	Debian DSA-2426-1 : gimp - several vulnerabilities	Nessus	Debian Local Security Checks	high
57199	SuSE 10 Security Update : gimp (ZYPP Patch Number 7543)	Nessus	SuSE Local Security Checks	high
55113	Ubuntu 10.04 LTS / 10.10 / 11.04 : gimp vulnerability (USN-1147-1)	Nessus	Ubuntu Local Security Checks	high
55003	Fedora 13 : gimp-2.6.11-14.fc13 (2011-7397)	Nessus	Fedora Local Security Checks	high
54985	SuSE 11.1 Security Update : gimp (SAT Patch Number 4631)	Nessus	SuSE Local Security Checks	high
54977	Fedora 14 : gimp-2.6.11-14.fc14 (2011-7393)	Nessus	Fedora Local Security Checks	high
54919	Mandriva Linux Security Advisory : gimp (MDVSA-2011:103)	Nessus	Mandriva Local Security Checks	high
54914	Fedora 15 : gimp-2.6.11-14.fc15 (2011-7371)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2011-1782

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high