6.8 - USN-1559-1

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	GIMP vulnerabilities

Informations
Name	USN-1559-1	First vendor Publication	2012-09-10
Vendor	Ubuntu	Last vendor Modification	2012-09-10
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.04 LTS

Summary:

GIMP could be made to crash or run programs as your login if it opened a specially crafted file.

Software Description: - gimp: The GNU Image Manipulation Program

Details:

Joseph Sheridan discovered that GIMP incorrectly handled certain malformed headers in FIT files. If a user were tricked into opening a specially crafted FIT image file, an attacker could cause GIMP to crash. (CVE-2012-3236)

Murray McAllister discovered that GIMP incorrectly handled malformed KiSS palette files. If a user were tricked into opening a specially crafted KiSS palette file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges. (CVE-2012-3403)

Matthias Weckbecker discovered that GIMP incorrectly handled malformed GIF image files. If a user were tricked into opening a specially crafted GIF image file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges. (CVE-2012-3481)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS:
gimp 2.6.12-1ubuntu1.1

Ubuntu 11.10:
gimp 2.6.11-2ubuntu4.1

Ubuntu 11.04:
gimp 2.6.11-1ubuntu6.3

Ubuntu 10.04 LTS:
gimp 2.6.8-2ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1559-1
CVE-2012-3236, CVE-2012-3403, CVE-2012-3481

Package Information:
https://launchpad.net/ubuntu/+source/gimp/2.6.12-1ubuntu1.1
https://launchpad.net/ubuntu/+source/gimp/2.6.11-2ubuntu4.1
https://launchpad.net/ubuntu/+source/gimp/2.6.11-1ubuntu6.3
https://launchpad.net/ubuntu/+source/gimp/2.6.8-2ubuntu1.5

Original Source

Url : http://www.ubuntu.com/usn/USN-1559-1

CWE : Common Weakness Enumeration

%	Id	Name
33 %	CWE-787	Out-of-bounds Write (CWE/SANS Top 25)
33 %	CWE-476	NULL Pointer Dereference
33 %	CWE-190	Integer Overflow or Wraparound (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18090

Oval ID:	oval:org.mitre.oval:def:18090
Title:	USN-1559-1 -- gimp vulnerabilities
Description:	GIMP could be made to crash or run programs as your login if it opened a specially crafted file.
Family:	unix	Class:	patch
Reference(s):	USN-1559-1 CVE-2012-3236 CVE-2012-3403 CVE-2012-3481	Version:	7
Platform(s):	Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04	Product(s):	gimp
Definition Synopsis:
Release section Ubuntu 12.04 is installed AND gimp DPKG is earlier than 2.6.12-1ubuntu1.1 AND Release section Ubuntu 11.10 is installed AND gimp DPKG is earlier than 2.6.11-2ubuntu4.1 AND Release section Ubuntu 11.04 is installed AND gimp DPKG is earlier than 2.6.11-1ubuntu6.3 AND Release section Ubuntu 10.04 is installed AND gimp DPKG is earlier than 2.6.8-2ubuntu1.5

Definition Id: oval:org.mitre.oval:def:20952

Oval ID:	oval:org.mitre.oval:def:20952
Title:	RHSA-2012:1181: gimp security update (Moderate)
Description:	Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Family:	unix	Class:	patch
Reference(s):	RHSA-2012:1181-00 CESA-2012:1181 CVE-2009-3909 CVE-2011-2896 CVE-2012-3402 CVE-2012-3403 CVE-2012-3481	Version:	68
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	gimp
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section gimp-libs is earlier than 2:2.2.13-2.0.7.el5_8.5 AND gimp-devel is earlier than 2:2.2.13-2.0.7.el5_8.5 AND gimp is earlier than 2:2.2.13-2.0.7.el5_8.5

Definition Id: oval:org.mitre.oval:def:21603

Oval ID:	oval:org.mitre.oval:def:21603
Title:	RHSA-2012:1180: gimp security update (Moderate)
Description:	Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Family:	unix	Class:	patch
Reference(s):	RHSA-2012:1180-01 CESA-2012:1180 CVE-2011-2896 CVE-2012-3403 CVE-2012-3481	Version:	42
Platform(s):	Red Hat Enterprise Linux 6 CentOS Linux 6	Product(s):	gimp
Definition Synopsis:
Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section gimp-libs is earlier than 2:2.6.9-4.el6_3.3 AND gimp-devel is earlier than 2:2.6.9-4.el6_3.3 AND gimp-help-browser is earlier than 2:2.6.9-4.el6_3.3 AND gimp is earlier than 2:2.6.9-4.el6_3.3 AND gimp-devel-tools is earlier than 2:2.6.9-4.el6_3.3

Definition Id: oval:org.mitre.oval:def:23104

Oval ID:	oval:org.mitre.oval:def:23104
Title:	ELSA-2012:1181: gimp security update (Moderate)
Description:	Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:1181-00 CVE-2009-3909 CVE-2011-2896 CVE-2012-3402 CVE-2012-3403 CVE-2012-3481	Version:	25
Platform(s):	Oracle Linux 5	Product(s):	gimp
Definition Synopsis:
Oracle Linux 5.x rpm test gimp-libs is earlier than 2:2.2.13-2.0.7.el5_8.5 AND gimp-devel is earlier than 2:2.2.13-2.0.7.el5_8.5 AND gimp is earlier than 2:2.2.13-2.0.7.el5_8.5

Definition Id: oval:org.mitre.oval:def:23466

Oval ID:	oval:org.mitre.oval:def:23466
Title:	ELSA-2012:1180: gimp security update (Moderate)
Description:	Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:1180-01 CVE-2011-2896 CVE-2012-3403 CVE-2012-3481	Version:	17
Platform(s):	Oracle Linux 6	Product(s):	gimp
Definition Synopsis:
Oracle Linux 6.x rpm test gimp-libs is earlier than 2:2.6.9-4.el6_3.3 AND gimp-devel is earlier than 2:2.6.9-4.el6_3.3 AND gimp-help-browser is earlier than 2:2.6.9-4.el6_3.3 AND gimp is earlier than 2:2.6.9-4.el6_3.3 AND gimp-devel-tools is earlier than 2:2.6.9-4.el6_3.3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Gimp cpe:2.3:a:gimp:gimp:2.8.22:::::::* cpe:2.3:a:gimp:gimp:2.8.2:::::::* cpe:2.3:a:gimp:gimp:2.6.9:::::::* cpe:2.3:a:gimp:gimp:2.6.8:::::::* cpe:2.3:a:gimp:gimp:2.6.7:::::::* cpe:2.3:a:gimp:gimp:2.6.6:::::::* cpe:2.3:a:gimp:gimp:2.6.5:::::::* cpe:2.3:a:gimp:gimp:2.6.4:::::::* cpe:2.3:a:gimp:gimp:2.6.3:::::::* cpe:2.3:a:gimp:gimp:2.6.2:::::::* cpe:2.3:a:gimp:gimp:2.6.13:::::::* cpe:2.3:a:gimp:gimp:2.6.12:::::::* cpe:2.3:a:gimp:gimp:2.6.11:::::::* cpe:2.3:a:gimp:gimp:2.6.10:::::::* cpe:2.3:a:gimp:gimp:2.6.1:::::::* cpe:2.3:a:gimp:gimp:2.6.0:::::::* cpe:2.3:a:gimp:gimp:2.4.7:::::::* cpe:2.3:a:gimp:gimp:2.4.6:::::::* cpe:2.3:a:gimp:gimp:2.4.5:::::::* cpe:2.3:a:gimp:gimp:2.4.4:::::::* cpe:2.3:a:gimp:gimp:2.4.3:::::::* cpe:2.3:a:gimp:gimp:2.4.2:::::::* cpe:2.3:a:gimp:gimp:2.4.1:::::::* cpe:2.3:a:gimp:gimp:2.4.0:::::::* cpe:2.3:a:gimp:gimp:2.2.4:::::::* cpe:2.3:a:gimp:gimp:2.2.3:::::::* cpe:2.3:a:gimp:gimp:2.2.14:::::::* cpe:2.3:a:gimp:gimp:2.2.13:::::::* cpe:2.3:a:gimp:gimp:2.2:::::::* cpe:2.3:a:gimp:gimp:2.0.5:::::::* cpe:2.3:a:gimp:gimp:2.0:::::::* cpe:2.3:a:gimp:gimp::::::::	32

ExploitDB Exploits

id	Description
2012-06-30	GIMP 2.8.0 FIT File Format DoS

OpenVAS Exploits

Date	Description
2012-12-13	Name : SuSE Update for gimp openSUSE-SU-2012:1080-1 (gimp) File : nvt/gb_suse_2012_1080_1.nasl
2012-09-11	Name : Ubuntu Update for gimp USN-1559-1 File : nvt/gb_ubuntu_USN_1559_1.nasl
2012-09-04	Name : Fedora Update for gimp FEDORA-2012-12364 File : nvt/gb_fedora_2012_12364_gimp_fc16.nasl
2012-08-30	Name : Fedora Update for gimp FEDORA-2012-12383 File : nvt/gb_fedora_2012_12383_gimp_fc17.nasl
2012-08-24	Name : Mandriva Update for gimp MDVSA-2012:142 (gimp) File : nvt/gb_mandriva_MDVSA_2012_142.nasl
2012-08-21	Name : CentOS Update for gimp CESA-2012:1180 centos6 File : nvt/gb_CESA-2012_1180_gimp_centos6.nasl
2012-08-21	Name : CentOS Update for gimp CESA-2012:1181 centos5 File : nvt/gb_CESA-2012_1181_gimp_centos5.nasl
2012-08-21	Name : RedHat Update for gimp RHSA-2012:1180-01 File : nvt/gb_RHSA-2012_1180-01_gimp.nasl
2012-08-21	Name : RedHat Update for gimp RHSA-2012:1181-01 File : nvt/gb_RHSA-2012_1181-01_gimp.nasl

Nessus® Vulnerability Scanner

Date	Description
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_gimp_20130219.nasl - Type : ACT_GATHER_INFO
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_gimp_20121009.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-543.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-583.nasl - Type : ACT_GATHER_INFO
2013-12-10	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2813.nasl - Type : ACT_GATHER_INFO
2013-11-11	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201311-05.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1180.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1181.nasl - Type : ACT_GATHER_INFO
2013-04-20	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-082.nasl - Type : ACT_GATHER_INFO
2013-01-25	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gimp-120713.nasl - Type : ACT_GATHER_INFO
2013-01-25	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gimp-120816.nasl - Type : ACT_GATHER_INFO
2013-01-25	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_gimp-120823.nasl - Type : ACT_GATHER_INFO
2012-09-18	Name : The remote Fedora host is missing a security update. File : fedora_2012-12293.nasl - Type : ACT_GATHER_INFO
2012-09-11	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1559-1.nasl - Type : ACT_GATHER_INFO
2012-09-06	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-142.nasl - Type : ACT_GATHER_INFO
2012-09-04	Name : The remote Fedora host is missing a security update. File : fedora_2012-12364.nasl - Type : ACT_GATHER_INFO
2012-08-29	Name : The remote Fedora host is missing a security update. File : fedora_2012-12383.nasl - Type : ACT_GATHER_INFO
2012-08-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_gimp-8253.nasl - Type : ACT_GATHER_INFO
2012-08-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1181.nasl - Type : ACT_GATHER_INFO
2012-08-21	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120820_gimp_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-21	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120820_gimp_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-21	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1180.nasl - Type : ACT_GATHER_INFO
2012-08-21	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1180.nasl - Type : ACT_GATHER_INFO
2012-08-21	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1181.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 12:00:41	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	5
CPE ID(s)	32
ExploitDB Exploit(s)	1
Openvas Exploit(s)	9
Nessus® Exploit(s)	24

	Related
6.8	CVE-2012-3481
6.8	CVE-2012-3403
4.3	CVE-2012-3236
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)