Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large (1) red, (2) green, or (3) blue color mask in an XWD file.

- Add gimp-CVE-2012-5576.patch: fix memory corruption     vulnerability when reading XWD files (bnc#791372,     bgo#687392, CVE-2012-5576).

This update fixes the following security issues with gimp :

  - XWD plugin g_new() integer overflow. (CVE-2013-1913).
    (bnc#853423)

  - XWD plugin color map heap-based buffer overflow.
    (CVE-2013-1978). (bnc#853425)

  - memory corruption via XWD files (CVE-2012-5576).
    (bnc#791372)

A stack-based buffer overflow flaw, a heap-based buffer overflow, and an integer overflow flaw were found in the way GIMP loaded certain X Window System (XWD) image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)

The GIMP must be restarted for the update to take effect.

Updated gimp packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

A stack-based buffer overflow flaw, a heap-based buffer overflow, and an integer overflow flaw were found in the way GIMP loaded certain X Window System (XWD) image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)

The CVE-2013-1913 and CVE-2013-1978 issues were discovered by Murray McAllister of the Red Hat Security Response Team.

Users of the GIMP are advised to upgrade to these updated packages, which correct these issues. The GIMP must be restarted for the update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1778 advisory.

    - fix overflow in XWD loader (CVE-2013-1913, CVE-2013-1978)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201311-05 (GIMP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GIMP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted KiSS       palette, GIF image or XWD file using GIMP, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Updated gimp packages fix security vulnerabilities :

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's GIF image format plug-in. An attacker could create a specially crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP (CVE-2012-3481).

A heap-based buffer overflow flaw was found in the GIMP's KiSS CEL file format plug-in. An attacker could create a specially crafted KiSS palette file that, when opened, could cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP (CVE-2012-3403).

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string. (CVE-2012-3236)

GIMP 2.8.2 and earlier is vulnerable to memory corruption when reading XWD files, which could lead even to arbitrary code execution (CVE-2012-5576).

Additionally it fixes partial translations in several languages.

This gimp update provides the stable maintenance release 2.8.2 which fixes the above security issues.

Among other things this update fixes a vulnerability with corrupt XWD files and a crash with newer versions of fontconfig when gimp is quit.

Overview of Changes from GIMP 2.8.2 to GIMP 2.8.4 =================================================

GUI :

  - Better names for the default filters in save and export

    - Make tool drawing (esp. the brush outline) much more       responsive

    - Remember the 'maximized' state across sessions

    - Simplify the splash image code a lot, makes it appear       immediately again

    - Allow the text tool to start on an image without       layers

    - Various fixes for text style attribute handling

    - Set unconfigured input devices to eraser if GTK+ says       they are erasers

Libgimp :

  - Make libgimp drawable combo boxes aware of layer groups

    - Fix item width in GimpPageSelector (used e.g. in PDF       import)

Plug-ins :

  - Better default values in the Drop Shadow script

    - Fix a whole bunch of bugs in the BMP plug-in

General :

  - Lots of bug fixes

    - Lots of translation updates

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that GIMP incorrectly handled malformed XWD files.
If a user were tricked into opening a specially crafted XWD file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74836	openSUSE Security Update : gimp (openSUSE-SU-2012:1623-1)	Nessus	SuSE Local Security Checks	high
72422	SuSE 11.3 Security Update : gimp (SAT Patch Number 8856)	Nessus	SuSE Local Security Checks	high
71303	Scientific Linux Security Update : gimp on SL5.x, SL6.x i386/x86_64 (20131203)	Nessus	Scientific Linux Local Security Checks	high
71189	RHEL 5 / 6 : gimp (RHSA-2013:1778)	Nessus	Red Hat Local Security Checks	high
71186	Oracle Linux 5 / 6 : gimp (ELSA-2013-1778)	Nessus	Oracle Linux Local Security Checks	high
71178	CentOS 5 / 6 : gimp (CESA-2013:1778)	Nessus	CentOS Local Security Checks	high
70835	GLSA-201311-05 : GIMP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
66096	Mandriva Linux Security Advisory : gimp (MDVSA-2013:082)	Nessus	Mandriva Local Security Checks	high
64733	Fedora 17 : gimp-2.8.4-1.fc17 (2013-2000)	Nessus	Fedora Local Security Checks	high
63220	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : gimp vulnerability (USN-1659-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2012-5576

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high