Executive Summary

Summary
Title GIMP vulnerabilities
Informations
NameUSN-880-1First vendor Publication2010-01-07
VendorUbuntuLast vendor Modification2010-01-07
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score9.3Attack RangeNetwork
Cvss Impact Score10Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
gimp 2.4.5-1ubuntu2.1

Ubuntu 8.10:
gimp 2.6.1-1ubuntu3.1

Ubuntu 9.04:
gimp 2.6.6-0ubuntu1.1

Ubuntu 9.10:
gimp 2.6.7-1ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Stefan Cornelius discovered that GIMP did not correctly handle certain
malformed BMP files. If a user were tricked into opening a specially
crafted BMP file, an attacker could execute arbitrary code with the user's
privileges. (CVE-2009-1570)

Stefan Cornelius discovered that GIMP did not correctly handle certain
malformed PSD files. If a user were tricked into opening a specially
crafted PSD file, an attacker could execute arbitrary code with the user's
privileges. This issue only applied to Ubuntu 8.10, 9.04 and 9.10.
(CVE-2009-3909)


Original Source

Url : http://www.ubuntu.com/usn/USN-880-1

CWE : Common Weakness Enumeration

idName
CWE-189Numeric Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:8290
 
Oval ID: oval:org.mitre.oval:def:8290
Title: An Integer Overflow Vulnerability in GIMP(1) May Lead to Denial of Service (DoS) or Execution of Arbitrary Code
Description: Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-based buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2009-1570
Version: 1
Platform(s): Sun Solaris 10
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application1

OpenVAS Exploits

DateDescription
2012-10-03Name : Gentoo Security Advisory GLSA 201209-23 (gimp)
File : nvt/glsa_201209_23.nasl
2012-08-21Name : RedHat Update for gimp RHSA-2012:1181-01
File : nvt/gb_RHSA-2012_1181-01_gimp.nasl
2012-08-21Name : CentOS Update for gimp CESA-2012:1181 centos5
File : nvt/gb_CESA-2012_1181_gimp_centos5.nasl
2012-07-30Name : CentOS Update for gimp CESA-2011:0837 centos4 x86_64
File : nvt/gb_CESA-2011_0837_gimp_centos4_x86_64.nasl
2012-07-30Name : CentOS Update for gimp CESA-2011:0838 centos5 x86_64
File : nvt/gb_CESA-2011_0838_gimp_centos5_x86_64.nasl
2011-08-09Name : CentOS Update for gimp CESA-2011:0838 centos5 i386
File : nvt/gb_CESA-2011_0838_gimp_centos5_i386.nasl
2011-06-06Name : CentOS Update for gimp CESA-2011:0837 centos4 i386
File : nvt/gb_CESA-2011_0837_gimp_centos4_i386.nasl
2011-06-06Name : RedHat Update for gimp RHSA-2011:0837-01
File : nvt/gb_RHSA-2011_0837-01_gimp.nasl
2011-06-06Name : RedHat Update for gimp RHSA-2011:0838-01
File : nvt/gb_RHSA-2011_0838-01_gimp.nasl
2010-04-30Name : Mandriva Update for gimp MDVSA-2009:332-1 (gimp)
File : nvt/gb_mandriva_MDVSA_2009_332_1.nasl
2010-02-03Name : Solaris Update for GNOME 2.6.0 143510-01
File : nvt/gb_solaris_143510_01.nasl
2010-02-03Name : Solaris Update for GIMP 143511-01
File : nvt/gb_solaris_143511_01.nasl
2010-01-15Name : Ubuntu Update for gimp vulnerabilities USN-880-1
File : nvt/gb_ubuntu_USN_880_1.nasl
2009-12-14Name : Mandriva Security Advisory MDVSA-2009:296-1 (gimp)
File : nvt/mdksa_2009_296_1.nasl
2009-12-03Name : Debian Security Advisory DSA 1941-1 (poppler)
File : nvt/deb_1941_1.nasl
0000-00-00Name : Slackware Advisory SSA:2009-345-01 gimp
File : nvt/esoft_slk_ssa_2009_345_01.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
60178GIMP plug-ins/file-psd/psd-load.c read_channel_data() Function PSD Image Hand...
59930GIMP plug-ins/file-bmp/bmp-read.c ReadImage() Function Overflow

Nessus® Vulnerability Scanner

DateDescription
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-0837.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-0838.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-1181.nasl - Type : ACT_GATHER_INFO
2013-06-28Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-0838.nasl - Type : ACT_GATHER_INFO
2012-09-29Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-23.nasl - Type : ACT_GATHER_INFO
2012-08-21Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-1181.nasl - Type : ACT_GATHER_INFO
2012-08-21Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120820_gimp_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-21Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-1181.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20110531_gimp_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20110531_gimp_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2011-06-02Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-0837.nasl - Type : ACT_GATHER_INFO
2011-06-01Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0837.nasl - Type : ACT_GATHER_INFO
2011-06-01Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0838.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gimp-6880.nasl - Type : ACT_GATHER_INFO
2011-01-27Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gimp-6882.nasl - Type : ACT_GATHER_INFO
2010-12-02Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_gimp-100318.nasl - Type : ACT_GATHER_INFO
2010-04-29Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-332.nasl - Type : ACT_GATHER_INFO
2010-04-15Name : The remote SuSE system is missing a security patch for gimp
File : suse_11_1_gimp-100318.nasl - Type : ACT_GATHER_INFO
2010-04-15Name : The remote SuSE system is missing a security patch for gimp
File : suse_11_0_gimp-100318.nasl - Type : ACT_GATHER_INFO
2010-04-15Name : The remote SuSE system is missing a security patch for gimp
File : suse_11_2_gimp-100318.nasl - Type : ACT_GATHER_INFO
2010-02-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1941.nasl - Type : ACT_GATHER_INFO
2010-01-08Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-880-1.nasl - Type : ACT_GATHER_INFO
2009-12-14Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-296.nasl - Type : ACT_GATHER_INFO
2009-12-14Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2009-345-01.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 12:06:29
  • Multiple Updates