A vulnerability has been discovered in GIMP, which can lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.10.38-r3, < 3.0.6 | >= 2.10.38-r3, >= 3.0.6 |
GIMP is the GNU Image Manipulation Program. XCF is the native image file format used by GIMP.
A vulnerability has been discovered in GIMP. Please review the CVE identifier referenced below for details.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
There is no known workaround at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-3.0.6"
All GIMP 2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.10.38-r3 =media-gfx/gimp-2*"
Multiple vulnerabilities have been discovered in GIMP, the worst of which can lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.10.36 | >= 2.10.36 |
GIMP is the GNU Image Manipulation Program. XCF is the native image file format used by GIMP.
Multiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.10.36"
GIMP is vulnerable to multiple buffer overflows which could result in the execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.8.0 | >= 2.8.0 |
GIMP is a cross-platform image editor available for GNU/Linux, OS X, Windows and more operating systems.
GIMP’s network server, scriptfu, is vulnerable to the remote execution of arbitrary code via the python-fu-eval command due to not requiring authentication. Additionally, the X Window Dump (XWD) plugin is vulnerable to multiple buffer overflows possibly allowing the remote execution of arbitrary code or Denial of Service. The XWD plugin is vulnerable due to not validating large color entries.
A remote attacker could possibly execute arbitrary code with the privileges of the process due or perform a Denial of Service.
There is no known work around at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.8.0"
Multiple vulnerabilities have been found in GIMP, the worst of which allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.8.2-r1 | >= 2.8.2-r1 |
GIMP is the GNU Image Manipulation Program.
Multiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted KiSS palette, GIF image or XWD file using GIMP, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.8.2-r1"
Multiple vulnerabilities have been found in GIMP, the worst of which allow execution of arbitrary code or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.6.12-r2 | >= 2.6.12-r2 |
GIMP is the GNU Image Manipulation Program.
Multiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.6.12-r2"
Multiple vulnerabilities have been discovered in GIMP, allowing for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.2.16 | >= 2.2.16 |
GIMP is the GNU Image Manipulation Program.
Sean Larsson from iDefense Labs discovered multiple integer overflows in various GIMP plugins (CVE-2006-4519). Stefan Cornelius from Secunia Research discovered an integer overflow in the seek_to_and_unpack_pixeldata() function when processing PSD files (CVE-2007-2949).
A remote attacker could entice a user to open a specially crafted image file, possibly resulting in the execution of arbitrary code with the privileges of the user running GIMP.
There is no known workaround at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.2.16"
GIMP is vulnerable to a buffer overflow which may lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.2.14 | >= 2.2.14 |
GIMP is the GNU Image Manipulation Program.
Marsu discovered that the "set_color_table()" function in the SUNRAS plugin is vulnerable to a stack-based buffer overflow.
An attacker could entice a user to open a specially crafted .RAS file, possibly leading to the execution of arbitrary code with the privileges of the user running GIMP.
There is no known workaround at this time.
All GIMP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.2.14"
GIMP is prone to a buffer overflow which may lead to the execution of arbitrary code when loading specially crafted XCF files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| media-gfx/gimp | * | < 2.2.12 | >= 2.2.12 |
GIMP is the GNU Image Manipulation Program. XCF is the native image file format used by GIMP.
Henning Makholm discovered that the "xcf_load_vector()" function is vulnerable to a buffer overflow when loading a XCF file with a large "num_axes" value.
An attacker could exploit this issue to execute arbitrary code by enticing a user to open a specially crafted XCF file.
There is no known workaround at this time.
All GIMP users should update to the latest stable version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-gfx/gimp-2.2.12"