Executive Summary
Summary | |
---|---|
Title | gimp security update |
Informations | |||
---|---|---|---|
Name | RHSA-2007:0343 | First vendor Publication | 2007-05-21 |
Vendor | RedHat | Last vendor Modification | 2007-05-21 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated gimp packages that fix a security issue are now available for Red Hat Enterprise Linux. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. Marsu discovered a stack overflow bug in The GIMP RAS file loader. An attacker could create a carefully crafted file that could cause The GIMP to crash or possibly execute arbitrary code if the file was opened by a victim. (CVE-2007-2356) For users of Red Hat Enterprise Linux 5, the previous GIMP packages had a bug that concerned the execution order in which the symbolic links to externally packaged GIMP plugins are installed and removed, causing the symbolic links to vanish when the package is updated. Users of The GIMP should update to these erratum packages which contain a backported fix to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 Although the execution order problem in GIMP packages for Red Hat Enterprise Linux 5 is fixed in these erratum packages, due to the nature of the problem it will show up once more when updating from an affected version to a fixed version. To add these symbolic links back in, run the following command after installation of the new packages: /usr/sbin/gimp-plugin-mgr --install \* 5. Bug IDs fixed (http://bugzilla.redhat.com/): 238420 - CVE-2007-2356 Stack overflow in gimp's sunras plugin 238993 - gimp removes symlinks to plugins of other packages when updated |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2007-0343.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:10054 | |||
Oval ID: | oval:org.mitre.oval:def:10054 | ||
Title: | Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file. | ||
Description: | Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-2356 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:20465 | |||
Oval ID: | oval:org.mitre.oval:def:20465 | ||
Title: | DSA-1301-1 gimp | ||
Description: | A buffer overflow has been identified in Gimp's SUNRAS plugin in versions prior to 2.2.15. This bug could allow an attacker to execute arbitrary code on the victim's computer by inducing the victim to open a specially crafted RAS file. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-1301-1 CVE-2007-2356 | Version: | 5 |
Platform(s): | Debian GNU/Linux 4.0 | Product(s): | gimp |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21752 | |||
Oval ID: | oval:org.mitre.oval:def:21752 | ||
Title: | ELSA-2007:0343: gimp security update (Moderate) | ||
Description: | Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2007:0343-02 CVE-2007-2356 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | gimp |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:5960 | |||
Oval ID: | oval:org.mitre.oval:def:5960 | ||
Title: | SUNRAS Plugin of Gimp Vulnerability | ||
Description: | Stack-based buffer overflow in the set_color_table function in sunras.c in the SUNRAS plugin in Gimp 2.2.14 allows user-assisted remote attackers to execute arbitrary code via a crafted RAS file. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2007-2356 | Version: | 1 |
Platform(s): | Sun Solaris 9 Sun Solaris 10 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
OpenVAS Exploits
Date | Description |
---|---|
2009-09-23 | Name : Solaris Update for GNOME 2.6.0 122212-33 File : nvt/gb_solaris_122212_33.nasl |
2009-09-23 | Name : Solaris Update for GNOME Desktop 122213-33 File : nvt/gb_solaris_122213_33.nasl |
2009-06-03 | Name : Solaris Update for GNOME 2.6.0 122212-32 File : nvt/gb_solaris_122212_32.nasl |
2009-06-03 | Name : Solaris Update for GNOME Desktop 122213-32 File : nvt/gb_solaris_122213_32.nasl |
2009-04-09 | Name : Mandriva Update for gimp MDKSA-2007:108 (gimp) File : nvt/gb_mandriva_MDKSA_2007_108.nasl |
2009-03-23 | Name : Ubuntu Update for gimp vulnerability USN-467-1 File : nvt/gb_ubuntu_USN_467_1.nasl |
2008-09-24 | Name : Gentoo Security Advisory GLSA 200705-08 (gimp) File : nvt/glsa_200705_08.nasl |
2008-01-17 | Name : Debian Security Advisory DSA 1301-1 (gimp) File : nvt/deb_1301_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
35417 | GIMP SUNRAS Plugin RAS File Handling set_color_table() Function Overflow |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0343.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070521_gimp_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_gimp-3283.nasl - Type : ACT_GATHER_INFO |
2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-467-1.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_gimp-3282.nasl - Type : ACT_GATHER_INFO |
2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_gimp-unstable-3281.nasl - Type : ACT_GATHER_INFO |
2007-06-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1301.nasl - Type : ACT_GATHER_INFO |
2007-05-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0343.nasl - Type : ACT_GATHER_INFO |
2007-05-25 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-108.nasl - Type : ACT_GATHER_INFO |
2007-05-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0343.nasl - Type : ACT_GATHER_INFO |
2007-05-10 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200705-08.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:50:38 |
|