PT-2009-4060 · Gnu+1 · Gimp+1

Published 2009-11-13 · Updated 2022-02-07 · CVE-2009-1570

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GIMP version 2.6.7

Description: The issue is related to an integer overflow in the ReadImage function, specifically in the plug-ins/file-bmp/bmp-read.c file. This overflow can be triggered by a BMP file with manipulated width and height values, leading to a heap-based buffer overflow. This could potentially allow remote attackers to execute arbitrary code.

Recommendations: For GIMP version 2.6.7, consider disabling the ReadImage function in the plug-ins/file-bmp/bmp-read.c file as a temporary workaround until a patch is available. Restrict the use of BMP files with crafted width and height values to minimize the risk of exploitation.

Fix

RCE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2009-1570

RHSA-2011:0837

RHSA-2011:0838

RHSA-2011_0837

RHSA-2011_0838

Affected Products

Gimp

Red Hat

References · 33

• https://osv.dev/vulnerability/CVE-2009-1570 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html · Vendor Advisory
• http://vupen.com/english/advisories/2009/3228 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1570 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0837.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1570 · Security Note
• http://git.gnome.org/cgit/gimp/commit/?h=gimp-2-6&id=df2b0aca2e7cdb95ebfd3454c65aaba0a83e9bbe · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201209-23.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0838.html · Vendor Advisory
• http://secunia.com/advisories/37232 · Note
• https://bugzilla.gnome.org/show_bug.cgi?id=600484 · Note
• http://vupen.com/english/advisories/2010/1021 · Note
• http://secunia.com/advisories/50737 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=666793 · Note