Heap-based buffer overflow in the KiSS CEL file format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted KiSS palette file, which triggers an "invalid free."

The remote Solaris system is missing necessary patches to address security updates :

  - Heap-based buffer overflow in the KiSS CEL file format     plug-in in GIMP 2.8.x and earlier allows remote     attackers to cause a denial of service and possibly     execute arbitrary code via a crafted KiSS palette file,     which triggers an 'invalid free.' (CVE-2012-3403)

  - Integer overflow in the ReadImage function in     plug-ins/common/file-gif-load.c in the GIF image format     plug-in in GIMP 2.8.x and earlier allows remote     attackers to cause a denial of service (application     crash) and possibly execute arbitrary code via crafted     height and len properties in a GIF image file, which     triggers a heap-based buffer overflow. NOTE: some of     these details are obtained from third party information.
    (CVE-2012-3481)

Multiple integer overflows in various decoder plug-ins of GIMP have been fixed.

The remote host is affected by the vulnerability described in GLSA-201311-05 (GIMP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GIMP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted KiSS       palette, GIF image or XWD file using GIMP, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1181 advisory.

    - fix overflow in GIF loader (CVE-2012-3481)
    - fix overflows in PSD plugin (CVE-2009-3909, CVE-2012-3402)
    - fix heap corruption and overflow in GIF plug-in (CVE-2011-2896)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1180 advisory.

    [2:2.6.9-4.3]
    - fix overflow in GIF loader (#847303)

    [2:2.6.9-4.2]
    - fix overflows in GIF, CEL loaders (#727800, #839020)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated gimp packages fix security vulnerabilities :

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP (CVE-2012-3481).

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP (CVE-2012-3403).

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string. (CVE-2012-3236)

GIMP 2.8.2 and earlier is vulnerable to memory corruption when reading XWD files, which could lead even to arbitrary code execution (CVE-2012-5576).

Additionally it fixes partial translations in several languages.

This gimp update provides the stable maintenance release 2.8.2 which fixes the above security issues.

This update of The Gimp fixes a heap overflow that could have been exploited by attackers to cause a Denial of Service (application crash) or even to potentially execute arbitrary code. (CVE-2012-3403)

Among other things this update fixes security and stability issues in various image format loaders. Security issues fixed include CVE-2012-3403 and CVE-2012-3481.

Overview of Changes from GIMP 2.8.0 to GIMP 2.8.2 =================================================

Core :

  - Make tag matching always case-insensitive

    - Let the tile-cache-size default to half the physical       memory

GUI :

  - Mention that the image was exported in the close warning     dialog

    - Make sure popup windows appear on top on OSX

    - Allow file opening by dropping to the OSX dock

    - Fix the visibility logic of the export/overwrite menu       items

    - Remove all 'Use GEGL' menu items, they only add bugs       and zero function

    - Improve performance of display filters, especially       color management

    - Fix the image window title to comply with the       save/export spec and use the same image name       everywhere, not only in the title

  - Fix positioning of pasted/dropped stuff to be more     reasonable

Libgimp :

  - Move gimpdir and thumbnails to proper locations on OSX

    - Implement relocation on OSX

    - Allow to use $(gimp_installation_dir) in config files

Plug-ins :

  - Fix remembering of JPEG load/save defaults

    - Revive the page setup dialog on Windows

Source and build system :

  - Add Windows installer infrastructure

    - Add infrastructure to build GIMP.app on OSX

General :

  - Lots of bug fixes

    - List of translation updates

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Joseph Sheridan discovered that GIMP incorrectly handled certain malformed headers in FIT files. If a user were tricked into opening a specially crafted FIT image file, an attacker could cause GIMP to crash. (CVE-2012-3236)

Murray McAllister discovered that GIMP incorrectly handled malformed KiSS palette files. If a user were tricked into opening a specially crafted KiSS palette file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.
(CVE-2012-3403)

Matthias Weckbecker discovered that GIMP incorrectly handled malformed GIF image files. If a user were tricked into opening a specially crafted GIF image file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.
(CVE-2012-3481).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in gimp :

A heap-based buffer overflow flaw, leading to invalid free, was found in the way KISS CEL file format plug-in of Gimp, the GNU Image Manipulation Program, performed loading of certain palette files. A remote attacker could provide a specially crafted KISS palette file that, when opened in Gimp would cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the gimp executable (CVE-2012-3403).

Integer overflow, leading to heap-based buffer overflow flaw was found in the GIMP's GIF (Graphics Interchange Format) image file plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP (CVE-2012-3481).

The updated gimp packages have been upgraded to the 2.6.12 version and patched to correct these issues.

Additionally for Mandriva Enterprise server 5 the gegl packages was upgraded to the 0.0.22 version and rebuilt for ffmpeg 0.5.9, the enscript packages was added because of a build dependency, the gutenprint and mtink packages was rebuilt against the gimp 2.6.12 libraries.

This update fixes security and stability issues in various image format loaders. Security issues fixed include CVE-2012-3403 and CVE-2012-3481.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of The Gimp fixes a heap overflow that could have been exploited by attackers to cause a Denial of Service (application crash) or even to potentially execute arbitrary code. (CVE-2012-3402)

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3481)

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2011-2896)

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3403)

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the GIMP's Adobe Photoshop (PSD) image file plug-in. An attacker could create a specially crafted PSD image file that, when opened, could cause the PSD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-3909, CVE-2012-3402)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3481)

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2011-2896)

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3403)

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

Updated gimp packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the GIMP's Adobe Photoshop (PSD) image file plug-in. An attacker could create a specially crafted PSD image file that, when opened, could cause the PSD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-3909, CVE-2012-3402)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3481)

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2011-2896)

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3403)

Red Hat would like to thank Secunia Research for reporting CVE-2009-3909, and Matthias Weckbecker of the SUSE Security Team for reporting CVE-2012-3481.

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

Updated gimp packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3481)

A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch (LZW) decompression algorithm implementation used by the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2011-2896)

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-3403)

Red Hat would like to thank Matthias Weckbecker of the SUSE Security Team for reporting the CVE-2012-3481 issue.

Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect.

ID	Name	Product	Family	Severity
80622	Oracle Solaris Third-Party Patch Update : gimp (multiple_vulnerabilities_in_gimp)	Nessus	Solaris Local Security Checks	medium
74735	openSUSE Security Update : gimp (openSUSE-SU-2012:1080-1)	Nessus	SuSE Local Security Checks	high
70835	GLSA-201311-05 : GIMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68601	Oracle Linux 5 : gimp (ELSA-2012-1181)	Nessus	Oracle Linux Local Security Checks	high
68600	Oracle Linux 6 : gimp (ELSA-2012-1180)	Nessus	Oracle Linux Local Security Checks	high
66096	Mandriva Linux Security Advisory : gimp (MDVSA-2013:082)	Nessus	Mandriva Local Security Checks	high
64148	SuSE 11.1 Security Update : gimp (SAT Patch Number 6683)	Nessus	SuSE Local Security Checks	medium
62135	Fedora 18 : gimp-2.8.2-1.fc18 (2012-12293)	Nessus	Fedora Local Security Checks	medium
62037	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : gimp vulnerabilities (USN-1559-1)	Nessus	Ubuntu Local Security Checks	medium
61987	Mandriva Linux Security Advisory : gimp (MDVSA-2012:142)	Nessus	Mandriva Local Security Checks	medium
61756	Fedora 16 : gimp-2.6.12-2.fc16 (2012-12364)	Nessus	Fedora Local Security Checks	medium
61703	Fedora 17 : gimp-2.8.2-1.fc17 (2012-12383)	Nessus	Fedora Local Security Checks	medium
61641	SuSE 10 Security Update : gimp (ZYPP Patch Number 8251)	Nessus	SuSE Local Security Checks	medium
61606	Scientific Linux Security Update : gimp on SL6.x i386/x86_64 (20120820)	Nessus	Scientific Linux Local Security Checks	medium
61605	Scientific Linux Security Update : gimp on SL5.x i386/x86_64 (20120820)	Nessus	Scientific Linux Local Security Checks	high
61604	RHEL 5 : gimp (RHSA-2012:1181)	Nessus	Red Hat Local Security Checks	high
61603	RHEL 6 : gimp (RHSA-2012:1180)	Nessus	Red Hat Local Security Checks	medium
61600	CentOS 5 : gimp (CESA-2012:1181)	Nessus	CentOS Local Security Checks	high
61599	CentOS 6 : gimp (CESA-2012:1180)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2012-3403

high

Tenable Plugins

medium

high

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

high

medium