GIMP vulnerabilities

GIMP has a signed integer overflow vulnerability in the file-fli plugin when processing FLI files, which can lead to application crashes.

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service.

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the load_layer() function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

A flaw was found in GIMP. A remote attacker could exploit this by tricking a user into opening a specially crafted PAA (Paint Shop Pro Array) image file. This vulnerability, a heap-based out-of-bounds write in the decode_lssz() function of the PAA file format plugin, allows data to be written beyond the intended memory buffer. This could lead to heap metadata corruption and potentially enable the attacker to execute arbitrary code on the affected system.

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. This out-of-bounds read vulnerability results in information disclosure of heap contents or a crash leading to a denial of service.

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow, potentially leading to arbitrary code execution or a denial of service.

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() causes an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A flaw was found in GIMP where the PlayStation TIM loader incorrectly calculates the CLUT size due to an integer overflow. Multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can exceed the maximum integer limit, leading to undefined behavior. An attacker can exploit this by providing a specially crafted image file, causing the plug-in to abort and resulting in a denial of service.

An off-by-one error was found in GIMP's PNM file format parser in the pnmscanner_gettoken() function. When parsing a crafted PNM file, a null terminator is written one byte past the end of a stack buffer, leading to memory corruption.

A heap buffer overflow vulnerability was found in GIMP's Paint Shop Pro (PSP) file format parser. The flaw occurs due to incorrect buffer size calculations when processing low bit-depth images, allowing a remote attacker to execute arbitrary code or cause a denial of service (DoS) by tricking a user into opening a specially crafted PSP file.

A double-free vulnerability was found in GIMP's PSP file format parser in the read_layer_block() function. This flaw can lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A vulnerability in GIMP allows remote code execution via a heap-based buffer overflow when parsing HDR files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

GIMP has a heap-based buffer overflow vulnerability in HDR file parsing, allowing remote code execution. User interaction is required (opening a malicious file or page).

A buffer overflow vulnerability was found in GIMP's `ReadJeffsImage` function when loading GIF files. Processing a specially crafted GIF file can cause a write beyond the allocated buffer.

A buffer overflow was found in GIMP's file-seattle-filmworks plugin, exploitable when a user opens a specially crafted Seattle Filmworks file. A remote attacker could cause a denial of service (DoS), crashing the plugin and potentially affecting GIMP stability.

In GIMP, processing a specially crafted PVR image file with large dimensions can cause a denial of service. A stack-based buffer overflow and out-of-bounds read in the PVR loader crash the application.

A heap buffer over-read in GIMP's icns_slurp() function occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure.

A flaw was found in GIMP: a stack buffer overflow in the TIM image loader's 4BPP decoding path. Opening a specially crafted TIM image file causes the application to crash due to an unconditional overflow when writing to a variable-length array, allowing a local user to cause a Denial of Service (DoS).

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data.

A vulnerability in GIMP allows remote code execution during XPM file parsing. The issue stems from missing validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required (opening a malicious file or page).

A heap-based buffer overflow vulnerability in GIMP's PSP file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

A heap-based buffer overflow vulnerability in GIMP's JP2 file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

Integer overflow vulnerability in GIMP ANI file parsing allows remote code execution. User interaction is required via opening a malicious file or visiting a malicious page.

A vulnerability in GIMP allows remote code execution through parsing of PSD files. The issue stems from missing validation of user-supplied data, leading to an integer overflow before buffer allocation. User interaction is required (opening a malicious file or page).

A vulnerability in GIMP's parsing of XWD files allows remote code execution via an out-of-bounds write. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage.

A heap-based buffer overflow vulnerability in GIMP's ICNS file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

A vulnerability in GIMP's XWD file parsing allows remote code execution due to improper validation of user-supplied data, resulting in an out-of-bounds write. User interaction is required, such as opening a malicious file or visiting a malicious page.

A vulnerability in GIMP's PGM file parsing allows remote code execution due to uninitialized memory access. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.

A heap-based buffer overflow vulnerability in GIMP's ICO file parsing allows remote code execution. Exploitation requires user interaction, such as opening a malicious file or visiting a crafted webpage.

A heap-based buffer overflow vulnerability in GIMP's PSP file parsing allows remote code execution. User interaction is required (opening a malicious file or page).

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer.

GIMP XCF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XCF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object.

GIMP LBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of LBM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer.

A vulnerability in GIMP's PNM file parsing allows an integer overflow before buffer allocation. Exploitation requires user interaction (opening a malicious file or visiting a malicious page). It can lead to remote code execution in the context of the current process.

A heap-based buffer overflow vulnerability in GIMP's parsing of XWD files allows remote attackers to execute arbitrary code. User interaction is required, as the target must open a malicious file or visit a malicious page.

A stack-based buffer overflow vulnerability in GIMP's ILBM file parsing allows remote attackers to execute arbitrary code. User interaction is required, as the target must visit a malicious page or open a malicious file. The flaw exists due to lack of proper validation of user-supplied data length before copying to a stack buffer.

GIMP has an integer overflow vulnerability in FF file parsing that can lead to remote code execution. User interaction is required — the target must visit a malicious page or open a malicious file.

A vulnerability in GIMP's WBMP file parsing allows an integer overflow before buffer allocation. Exploitation requires user interaction (opening a malicious file or page). It can lead to remote code execution in the context of the process.

A heap-based buffer overflow vulnerability in GIMP during DCM file parsing that allows remote code execution. The flaw results from lack of proper validation of user-supplied data length before copying it to a heap-based buffer. User interaction is required — the target must visit a malicious page or open a malicious file.

A heap-based buffer overflow vulnerability in GIMP's parsing of HDR files allows remote attackers to execute arbitrary code. User interaction is required, as the target must open a malicious file or visit a malicious page.

A vulnerability in GIMP's ICNS file parsing allows an out-of-bounds write. Exploitation requires user interaction (opening a malicious file or page). It can lead to remote code execution in the context of the process.

In GIMP, the "Despeckle" plug-in has an integer overflow vulnerability. Unchecked multiplication of image dimensions (width, height, bytes-per-pixel) can cause insufficient memory allocation and out-of-bounds writes.

A flaw was found in GIMP when processing XCF image files. If a user opens a specially crafted file, GIMP can be tricked into making serious memory errors, potentially leading to crashes and use-after-free issues.

A flaw was found in GIMP when processing specially crafted TGA image files. Opening such a file can cause serious memory errors, leading to a heap buffer overflow and potential crashes.

A vulnerability was found in GIMP's ani_load_image() function, causing a stack-based buffer overflow. Opening a specially crafted .ANI file may allow arbitrary code execution.