An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5681-1 advisory.

    It was discovered that gThumb did not properly managed memory under certain circumstances. An attacker     could possibly use this issue to cause gThumb to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2018-18718)

    It was discovered that gThumb did not properly managed memory when processing certain image files. If a     user were tricked into opening a specially crafted JPEG file, an attacker could possibly use this issue to     cause gThumb to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-20326)

    It was discovered that gThumb did not properly handled certain malformed image files. If a user were     tricked into opening a specially crafted JPEG file, an attacker could possibly use this issue to cause     gThumb to crash, resulting in a denial of service. (CVE-2020-36427)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for gthumb fixes the following issues :

Security issue fixed :

  - CVE-2018-18718: Fixed a double-free in     add_themes_from_dir function from dlg-contact-sheet.c     (boo#1113749)

CVE-2018-18718 - CWE-415: Double Free The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

There is a suspected double-free bug with static void add_themes_from_dir() dlg-contact-sheet.c. This method involves two successive calls of g_free(buffer) (line 354 and 373), and is likely to cause double-free of the buffer. One possible fix could be directly assigning the buffer to NULL after the first call of g_free(buffer).
Thanks Tianjun Wu https://gitlab.gnome.org/GNOME/gthumb/issues/18

For Debian 8 'Jessie', this problem has been fixed in version 3:3.3.1-2.1+deb8u1

We recommend that you upgrade your gthumb packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183105	Ubuntu 16.04 ESM / 18.04 ESM : gThumb vulnerabilities (USN-5681-1)	Nessus	Ubuntu Local Security Checks	high
121150	openSUSE Security Update : gthumb (openSUSE-2019-22)	Nessus	SuSE Local Security Checks	high
118735	Debian DLA-1567-1 : gthumb security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-18718

high

Tenable Plugins

high

high

high