GIMP vulnerabilities

In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.

In GIMP 2.8.22, there is a heap-based buffer over-read in the read_creator_block handler in plug-ins/common/file-psp.c.

In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c, related to an unexpected bits-per-pixel value for an RGBA image.

In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.

In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c, related to mishandling of UTF-8 data.

A use-after-free vulnerability in the xcf_load_image function in xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.

The file-psd plugin in GIMP contains a flaw where the channel-count parameter is not properly validated when processing specially crafted PSD files. This leads to improper memory bounds checking, resulting in a heap out-of-bounds read and a stack out-of-bounds access. This can cause an application crash, leading to denial of service or limited information disclosure of memory contents.

A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds reads. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.

The Seattle FilmWorks plugin in GIMP has a vulnerability involving unbounded stack allocation of a variable-length array when processing a specially crafted SFW file. This leads to an application crash and denial of service.

The file-xwd plugin in GIMP has a vulnerability due to incorrect validation of image width and bytes-per-line parameters when processing a specially crafted XWD file. This leads to a heap out-of-bounds read, which can cause an application crash or limited information disclosure of heap memory contents into the produced image.

The file-pix (ESM) plugin in GIMP contains a flaw where it allocates a Variable-Length Array (VLA) on the stack without proper bounds checking when processing a specially crafted PIX image file, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on image dimensions and number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing APNG files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of the length of user-supplied data before copying it to a heap-based buffer, leading to a heap-based buffer overflow. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing SGI files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before writing to memory. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer, leading to a stack-based buffer overflow. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing TIF files. The issue is due to lack of proper validation of the length of user-supplied data before copying it to a heap-based buffer, leading to a heap-based buffer overflow. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing PSD files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

This vulnerability allows a remote attacker to execute arbitrary code in GIMP when parsing HDR files. The issue is due to lack of proper validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required, such as opening a malicious file.

GIMP's file format plugins, including those for PSD and PAA files, contain a vulnerability that a remote attacker can exploit by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts.

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution.

GIMP has a signed integer overflow vulnerability in the file-fli plugin when processing FLI files, which can lead to application crashes.

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the load_layer() function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lssz() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. This out-of-bounds read vulnerability results in information disclosure of heap contents or a crash leading to a denial of service.

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow, potentially leading to arbitrary code execution or a denial of service.

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() causes an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A flaw was found in GIMP where the PlayStation TIM loader incorrectly calculates the CLUT size due to an integer overflow. Multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can exceed the maximum integer limit, leading to undefined behavior. An attacker can exploit this by providing a specially crafted image file, causing the plug-in to abort and resulting in a denial of service.

An off-by-one error was found in GIMP's PNM file format parser in the pnmscanner_gettoken() function. When parsing a crafted PNM file, a null terminator is written one byte past the end of a stack buffer, leading to memory corruption.

A heap buffer overflow vulnerability was found in GIMP's Paint Shop Pro (PSP) file format parser. The flaw occurs due to incorrect buffer size calculations when processing low bit-depth images, allowing a remote attacker to execute arbitrary code or cause a denial of service (DoS) by tricking a user into opening a specially crafted PSP file.

A double-free vulnerability was found in GIMP's PSP file format parser in the read_layer_block() function. This flaw can lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A vulnerability in GIMP allows remote code execution via a heap-based buffer overflow when parsing HDR files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

GIMP has a heap-based buffer overflow vulnerability in HDR file parsing, allowing remote code execution. User interaction is required (opening a malicious file or page).

A buffer overflow vulnerability was found in GIMP's `ReadJeffsImage` function when loading GIF files. Processing a specially crafted GIF file can cause a write beyond the allocated buffer.

A vulnerability in GIMP allows remote code execution during XPM file parsing. The issue stems from missing validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required (opening a malicious file or page).

A heap-based buffer overflow vulnerability in GIMP's PSP file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

A heap-based buffer overflow vulnerability in GIMP's JP2 file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

Integer overflow vulnerability in GIMP ANI file parsing allows remote code execution. User interaction is required via opening a malicious file or visiting a malicious page.

A vulnerability in GIMP allows remote code execution through parsing of PSD files. The issue stems from missing validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required (opening a malicious file or page).

A vulnerability in GIMP's parsing of XWD files allows remote code execution via an out-of-bounds write. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage.

A heap-based buffer overflow vulnerability in GIMP's ICNS file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.