gimp-2.99.8-4.el9_6
エラータID: AXSA:2025-10463:02
リリース日:
2025/07/14 Monday - 21:19
題名:
gimp-2.99.8-4.el9_6
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- GIMP の DDS ファイルの解析処理には、ヒープ領域のバッファー
オーバーフローの問題があるため、ローカルの攻撃者により、細工
された DDS ファイルの入力を介して、任意のコードの実行を可能と
する脆弱性が存在します。(CVE-2023-44441)
- GIMP の PSD ファイルの解析処理には、ヒープ領域のバッファー
オーバーフローの問題があるため、ローカルの攻撃者により、細工
された PSD ファイルの入力を介して、任意のコードの実行を可能と
する脆弱性が存在します。(CVE-2023-44442)
- GIMP の PSP ファイルの解析処理には、整数オーバーフローの問題が
あるため、ローカルの攻撃者により、細工された PSP ファイルの入力
を介して、任意のコードの実行を可能とする脆弱性が存在します。
(CVE-2023-44443)
- GIMP の PSP ファイルの解析処理には、ループ処理の回数制御の不備
に起因したメモリ領域の範囲外アクセスの問題があるため、ローカルの
攻撃者により、細工された PSP ファイルの入力を介して、任意のコード
の実行を可能とする脆弱性が存在します。(CVE-2023-44444)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-44441
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
CVE-2023-44442
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
CVE-2023-44443
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.
CVE-2023-44444
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
追加情報:
N/A
ダウンロード:
SRPMS
- gimp-2.99.8-4.el9_6.src.rpm
MD5: 8938d3cda142f961e70019cb3e770d8f
SHA-256: 14d560c123570dfac071afd8c2c9797e534580e2b449649afd643b25693b51b1
Size: 29.41 MB
Asianux Server 9 for x86_64
- gimp-2.99.8-4.el9_6.x86_64.rpm
MD5: 43641b6b8267e83747f1b84acee757e5
SHA-256: dac3f184b0d210015609b8323a3ad629a0dcfe394f9a8c480d70aaf8b25c779a
Size: 19.31 MB - gimp-libs-2.99.8-4.el9_6.i686.rpm
MD5: b968254ec60f62bd10da30faf493fdb4
SHA-256: d364ee6a50661df3325f439eea09caec8fa684d2723d09c59b01e46a43052d19
Size: 588.76 kB - gimp-libs-2.99.8-4.el9_6.x86_64.rpm
MD5: c27990b0e292c7d5280aef3ceec034a7
SHA-256: e25426c35084c1ecf6be701b9a05c7de807f4a639a3751fe2da3b774b429e59a
Size: 551.72 kB
English