gimp:2.8 security update

エラータID: AXSA:2025-9613:01

リリース日: 
2025/01/31 Friday - 19:57
題名: 
gimp:2.8 security update
影響のあるチャネル: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

以下項目について対処しました。

[Security Fix]
- GIMP の PSD ファイルの解析処理には、ヒープ領域のバッファー
オーバーフローの問題があるため、ローカルの攻撃者により、細工
された PSD ファイルの入力を介して、任意のコードの実行を可能
とする脆弱性が存在します。(CVE-2023-44442)

- GIMP の PSP ファイルの解析処理には、整数オーバーフロー
の問題があるため、ローカルの攻撃者により、細工された PSP
ファイルの入力を介して、任意のコードの実行を可能とする脆弱性
が存在します。(CVE-2023-44443)

- GIMP の PSP ファイルの解析処理には、ループ処理の回数制御
の不備に起因したメモリ領域の範囲外アクセスの問題があるため、
ローカルの攻撃者により、細工された PSP ファイルの入力を
介して、任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2023-44444)

Modularity name: gimp
Stream name: 2.8

解決策: 

パッケージをアップデートしてください。

CVE: 
CVE-2023-44442
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
CVE-2023-44443
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.
CVE-2023-44444
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
追加情報: 

N/A

ダウンロード: 

SRPMS
  1. gimp-2.8.22-26.module+el8+1844+84c666dc.src.rpm
    MD5: 6422df02a7664e180681814b02e142fd
    SHA-256: 54c53dfc16e6cfda9e285addecf1e0d281183129c1fe3fbf925a79d366a49cd3
    Size: 20.06 MB
  2. pygobject2-2.28.7-5.module+el8+1844+84c666dc.src.rpm
    MD5: 5d51b7a2d8b5edf204fb7d3ef393ce75
    SHA-256: 3cd0aa609ada84e02a016fa5dc4091aab134881959b8583830d21032a2c21c88
    Size: 750.83 kB
  3. pygtk2-2.24.0-25.module+el8+1844+84c666dc.src.rpm
    MD5: e0452effdfd642892209e16ed3d77c92
    SHA-256: 30e71fc4cbe5c97559b16e3e04ab3e413fe5edd353988083874e7f89e0330821
    Size: 2.28 MB
  4. python2-pycairo-1.16.3-7.module+el8+1844+84c666dc.src.rpm
    MD5: 56708efd2ba3bc5f7f49b97222259539
    SHA-256: 3fc579291256e7ae8137de7f6d7cb8f7fb7b748dfe0c3ba6848661b824761b9a
    Size: 199.60 kB

Asianux Server 8 for x86_64
  1. gimp-2.8.22-26.module+el8+1844+84c666dc.x86_64.rpm
    MD5: debefd36e9f1a5747258c2a08c03bc72
    SHA-256: a193103334916e25b7b2454512d3b1afc286e2289398435cbc47cef39bf70115
    Size: 14.96 MB
  2. gimp-debugsource-2.8.22-26.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 71ab14b4c623b925dfdc52eec5acd983
    SHA-256: d252b8c422447d7487bf2fe5db911221baef6b7961a3af1ef8927bd1fbd13459
    Size: 4.50 MB
  3. gimp-devel-2.8.22-26.module+el8+1844+84c666dc.x86_64.rpm
    MD5: e24e6d5e59db8596e9aa3c1b44ac41e2
    SHA-256: c4c27e624b891564f268836f1121873131b207e9c503a0d336fe71a001362c56
    Size: 939.85 kB
  4. gimp-devel-tools-2.8.22-26.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 0b41d0da7527895fb7918d6eb5fb8f1b
    SHA-256: 2fedda11180339145bf900f1cefd1e31c59e8a232b041850b46d6469b7302f77
    Size: 78.85 kB
  5. gimp-libs-2.8.22-26.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 4c4cc8a404407b20e097faf33fef0c90
    SHA-256: f2236026a3989a957ffeeab1291883541f01847de154a7ff61ad1d8ec2941f97
    Size: 1.40 MB
  6. pygobject2-2.28.7-5.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 591bd59ae83035a091b80a8057e8e4f6
    SHA-256: dcf22d64a4db2ddc1b99445b449b554413251bcc60dca19e4183af4a666aea98
    Size: 235.15 kB
  7. pygobject2-codegen-2.28.7-5.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 5d9bce237035ef774a5be68a2711304d
    SHA-256: d95bffff00039fcaaa6a58f129abb7d34b3e767eced4f49e0a3be5959e5f3476
    Size: 108.41 kB
  8. pygobject2-debugsource-2.28.7-5.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 8b66ea62a1f71449954741a8af939109
    SHA-256: 08c896d9a4d0634eb8905a64dc8dcb4e17a6cfcf094013ab7d6b3f9a5bc9e7e2
    Size: 156.13 kB
  9. pygobject2-devel-2.28.7-5.module+el8+1844+84c666dc.x86_64.rpm
    MD5: ac15c2c32ffe9f3e2fcb71b894cf9a14
    SHA-256: 1573cab32ccc0f5a4b4f849e23c4bb29fb91d68ab686084a8f207c8bb552a5a0
    Size: 71.82 kB
  10. pygobject2-doc-2.28.7-5.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 58fee75829b37e36f88d7364aa1a5901
    SHA-256: e6fa52f02c986f4d4ccc06d2591ce1deca6fe01c735dd5960f388464fde884d6
    Size: 129.60 kB
  11. pygtk2-2.24.0-25.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 970ed50ac9c47e5f88eae66560326366
    SHA-256: d57d6d21ea7694d6bb2ac2e5f0e4538cf7586c0e1b48547642d8b177b0629bdf
    Size: 928.55 kB
  12. pygtk2-codegen-2.24.0-25.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 7617c3f476d58270affafea6a0fe10d9
    SHA-256: a3eb685a89223b22a82f6a2e7bfef59f10e42f8129839403f4ab718eedbd944a
    Size: 22.19 kB
  13. pygtk2-debugsource-2.24.0-25.module+el8+1844+84c666dc.x86_64.rpm
    MD5: e5e4c7a7b30229cfec210b394222c165
    SHA-256: d10169113705b037fc3d10a7424e2839d774ca3236676b446cf95afb2adccbfc
    Size: 464.88 kB
  14. pygtk2-devel-2.24.0-25.module+el8+1844+84c666dc.x86_64.rpm
    MD5: dd72e3531bcdbd60b59297fe9bb1aa72
    SHA-256: 6cefffa9716fda09e84b035d0e8d5a67b3d5b6b525332c94845b69dce5766c6e
    Size: 151.10 kB
  15. pygtk2-doc-2.24.0-25.module+el8+1844+84c666dc.noarch.rpm
    MD5: 0b522c4e61b7caea60d8376623fe03a8
    SHA-256: 92008f68c6aca094b0e4fa21f9fd5d44166f8e54d1eefa50e0f58e0bbb3b2973
    Size: 1.19 MB
  16. python2-cairo-1.16.3-7.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 50c30caf7670ca691460e2bd7266ee30
    SHA-256: 779ef068691a2c22c511d1a72827c1bf1e28e7a170ca08526f88a11546948e5c
    Size: 88.66 kB
  17. python2-cairo-devel-1.16.3-7.module+el8+1844+84c666dc.x86_64.rpm
    MD5: d1ff7e4f4a9a9ce9abeea12ed8209348
    SHA-256: 095f0d6c993ef8cd06ab60f038d056d53da6e4715331a52b81f1139f9acfd93d
    Size: 15.97 kB
  18. python2-pycairo-debugsource-1.16.3-7.module+el8+1844+84c666dc.x86_64.rpm
    MD5: 2b57b0ed9f1cd02d04b5990ef998edec
    SHA-256: 82faf378b8c205f450676a929d9902557a6839dc254180cd70225e03745a2fe9
    Size: 55.97 kB