GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
CVSS Details
- CVSS 3.0 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gimp-libsUpgrade pygtk2-docUpgrade python2-cairoUpgrade gimpUpgrade pygtk2-develUpgrade python2-cairo-develUpgrade pygobject2-docUpgrade pygtk2-codegenUpgrade gimp-devel-toolsUpgrade pygobject2-codegenUpgrade gimp-develUpgrade pygobject2-develUpgrade pygtk2Upgrade pygobject2 | Feb 12, 2024 | Feb 5, 2024 |
| Alpine Linux | — | Upgrade gimp | Aug 22, 2024 | May 3, 2024 |
| Amazon Linux Ami 2 | — | Upgrade gimp-develUpgrade gimp-devel-toolsUpgrade gimp-debuginfoUpgrade gimp-libsUpgrade gimp | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade gimp | Nov 27, 2023 | Nov 27, 2023 |
| Gentoo Linux | — | Upgrade media-gfx/gimp. | Jan 20, 2025 | May 3, 2024 |
| Oracle_linux | — | Upgrade python2-cairoUpgrade gimp-libsUpgrade pygtk2-docUpgrade pygtk2Upgrade pygtk2-develUpgrade pygobject2-codegenUpgrade pygobject2Upgrade pygobject2-docUpgrade pygobject2-develUpgrade python2-cairo-develUpgrade gimp-devel-toolsUpgrade gimp-develUpgrade gimpUpgrade pygtk2-codegen | May 21, 2024 | Nov 14, 2023 |
| Redhat_linux | — | Upgrade gimpUpgrade pygobject2-codegenUpgrade pygobject2-debugsourceUpgrade pygtk2-debuginfoUpgrade pygtk2-develUpgrade gimp-devel-toolsUpgrade pygobject2-develUpgrade pygobject2-docUpgrade pygtk2-debugsourceUpgrade gimp-debuginfoUpgrade pygtk2-codegenUpgrade pygobject2-debuginfoUpgrade python2-pycairo-debugsourceUpgrade python2-cairo-develUpgrade pygtk2-docUpgrade gimp-develUpgrade gimp-debugsourceUpgrade gimp-devel-tools-debuginfoUpgrade gimp-libs-debuginfoUpgrade pygtk2Upgrade python2-cairo-debuginfoUpgrade python2-cairoUpgrade pygobject2Upgrade gimp-libsNo solution exists | Feb 7, 2024 | Nov 14, 2023 |
| Rocky_linux | — | Upgrade gimp-libsUpgrade pygobject2-codegenUpgrade pygobject2-docUpgrade gimpUpgrade pygtk2-codegenUpgrade pygobject2-debugsourceUpgrade pygtk2-develUpgrade python2-cairoUpgrade pygtk2-debugsourceUpgrade gimp-devel-toolsUpgrade pygobject2Upgrade python2-pycairo-debugsourceUpgrade python2-cairo-develUpgrade gimp-libs-debuginfoUpgrade gimp-devel-tools-debuginfoUpgrade pygobject2-develUpgrade pygobject2-debuginfoUpgrade pygtk2-debuginfoUpgrade pygtk2Upgrade gimp-debugsourceUpgrade gimp-debuginfoUpgrade gimp-develUpgrade python2-cairo-debuginfo | Aug 28, 2024 | May 3, 2024 |
| Suse | — | Upgrade libgimpui-2_0-0-32bitUpgrade libgimpui-2_0-0Upgrade gimp-langUpgrade gimp-plugin-aaUpgrade libgimp-2_0-0-32bitUpgrade libgimp-2_0-0Upgrade gimp-develUpgrade gimp-plugins-pythonUpgrade gimp | Dec 8, 2023 | Dec 8, 2023 |
| Ubuntu | — | Upgrade gimp | Nov 30, 2023 | Nov 29, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub