GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
CVSS Details
- CVSS 3.0 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gimpUpgrade pygtk2-docUpgrade pygtk2-develUpgrade gimp-libsUpgrade python2-cairoUpgrade pygobject2-docUpgrade gimp-devel-toolsUpgrade gimp-develUpgrade pygobject2-codegenUpgrade python2-cairo-develUpgrade pygobject2-develUpgrade pygtk2Upgrade pygobject2Upgrade pygtk2-codegen | Feb 12, 2024 | Feb 5, 2024 |
| Alpine Linux | — | Upgrade gimp | Aug 22, 2024 | May 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gimp-devel-toolsUpgrade gimp-debuginfoUpgrade gimpUpgrade gimp-develUpgrade gimp-libs | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade gimp | Nov 27, 2023 | Nov 27, 2023 |
| Gentoo Linux | — | Upgrade media-gfx/gimp. | Jan 20, 2025 | May 3, 2024 |
| Oracle_linux | — | Upgrade python2-cairoUpgrade gimp-libsUpgrade pygtk2-develUpgrade pygtk2-docUpgrade pygtk2Upgrade pygobject2-develUpgrade pygobject2-codegenUpgrade python2-cairo-develUpgrade gimp-devel-toolsUpgrade gimpUpgrade pygtk2-codegenUpgrade pygobject2-docUpgrade pygobject2Upgrade gimp-devel | May 21, 2024 | Nov 14, 2023 |
| Redhat_linux | — | Upgrade python2-pycairo-debugsourceUpgrade pygtk2Upgrade pygtk2-debuginfoUpgrade pygobject2-develNo solution existsUpgrade python2-cairoUpgrade python2-cairo-debuginfoUpgrade gimp-libsUpgrade gimp-devel-tools-debuginfoUpgrade gimp-debugsourceUpgrade pygtk2-docUpgrade gimp-libs-debuginfoUpgrade gimp-develUpgrade pygobject2-docUpgrade pygobject2-debuginfoUpgrade gimp-devel-toolsUpgrade pygtk2-codegenUpgrade python2-cairo-develUpgrade pygobject2-debugsourceUpgrade gimp-debuginfoUpgrade pygobject2Upgrade gimpUpgrade pygtk2-develUpgrade pygtk2-debugsourceUpgrade pygobject2-codegen | Feb 7, 2024 | Nov 14, 2023 |
| Rocky_linux | — | Upgrade python2-cairoUpgrade pygobject2Upgrade pygobject2-docUpgrade pygtk2-develUpgrade python2-cairo-develUpgrade pygtk2-debugsourceUpgrade gimp-devel-toolsUpgrade pygtk2-codegenUpgrade pygobject2-debugsourceUpgrade gimpUpgrade gimp-devel-tools-debuginfoUpgrade pygobject2-codegenUpgrade gimp-libsUpgrade python2-pycairo-debugsourceUpgrade gimp-libs-debuginfoUpgrade pygobject2-develUpgrade gimp-debuginfoUpgrade python2-cairo-debuginfoUpgrade pygtk2Upgrade pygobject2-debuginfoUpgrade gimp-debugsourceUpgrade gimp-develUpgrade pygtk2-debuginfo | Aug 28, 2024 | May 3, 2024 |
| Suse | — | Upgrade libgimpui-2_0-0-32bitUpgrade gimp-langUpgrade gimp-plugin-aaUpgrade gimp-plugins-pythonUpgrade gimp-develUpgrade gimpUpgrade libgimpui-2_0-0Upgrade libgimp-2_0-0Upgrade libgimp-2_0-0-32bit | Dec 8, 2023 | Dec 8, 2023 |
| Ubuntu | — | Upgrade gimp | Nov 30, 2023 | Nov 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub