gimp-2.99.8-4.el9_5
エラータID: AXSA:2025-9834:01
リリース日:
2025/04/08 Tuesday - 12:55
題名:
gimp-2.99.8-4.el9_5
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- GIMP の DDS ファイルの解析処理には、ヒープ領域のバッファー
オーバーフローの問題があるため、ローカルの攻撃者により、細工
された DDS ファイルの入力を介して、任意のコードの実行を可能と
する脆弱性が存在します。(CVE-2023-44441)
- GIMP の PSD ファイルの解析処理には、ヒープ領域のバッファー
オーバーフローの問題があるため、ローカルの攻撃者により、細工
された PSD ファイルの入力を介して、任意のコードの実行を可能と
する脆弱性が存在します。(CVE-2023-44442)
- GIMP の PSP ファイルの解析処理には、整数オーバーフローの問題が
あるため、ローカルの攻撃者により、細工された PSP ファイルの入力
を介して、任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2023-44443)
- GIMP の PSP ファイルの解析処理には、ループ処理の回数制御の不備
に起因したメモリ領域の範囲外アクセスの問題があるため、ローカルの
攻撃者により、細工された PSP ファイルの入力を介して、任意のコード
の実行を可能とする脆弱性が存在します。(CVE-2023-44444)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-44441
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
CVE-2023-44442
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
CVE-2023-44443
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.
CVE-2023-44444
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
追加情報:
N/A
ダウンロード:
SRPMS
- gimp-2.99.8-4.el9_5.src.rpm
MD5: 0ce04084353ff18e990826fe958bfabd
SHA-256: 5d662eb77fff11a93e644040c23f1fa96f8e3120a37e93c6d0ae36cdabf356dc
Size: 29.41 MB
Asianux Server 9 for x86_64
- gimp-2.99.8-4.el9_5.x86_64.rpm
MD5: d183b33904c765f251dc1aebdd243cea
SHA-256: 0e77fde3faf43bc184a057b72376b60a8f9e0be36c12a92336b6007282203a93
Size: 19.31 MB - gimp-libs-2.99.8-4.el9_5.i686.rpm
MD5: d1385d728fe593a81b10880367daf399
SHA-256: 6950c86320f611f87a1848538d24d49a930ae08966f45a065fd06d6391fe64d5
Size: 590.11 kB - gimp-libs-2.99.8-4.el9_5.x86_64.rpm
MD5: 4c47390acef8b67234928e2ec9dd7f9b
SHA-256: a997032df769e323707ce4d2c6294255539184f47098b7532b76bc2c62b5abbb
Size: 552.02 kB
English