PT-2011-2924 · Gnu+1 · Gimp+1

Jan Lieskovsky · Published 2011-05-31 · Updated 2023-02-13 · CVE-2011-1178

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GIMP versions 2.6.x and earlier

Description The issue is caused by multiple integer overflows in the load image function in the Personal Computer Exchange (PCX) plugin, which can lead to a denial of service (application crash) or possibly allow execution of arbitrary code. This can be triggered by a crafted PCX image that causes a heap-based buffer overflow.

Recommendations For GIMP versions 2.6.x and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, avoid using the PCX plugin to open potentially malicious images until a patch is available.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2011-1178

RHSA-2011:0837

RHSA-2011:0838

RHSA-2011_0837

RHSA-2011_0838

Affected Products

Gimp

Red Hat

References · 26

• http://mandriva.com/security/advisories?name=MDVSA-2011:110 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1178 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-1178 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=689831 · Patch
• http://git.gnome.org/browse/gimp/commit/?id=a9671395f6573e90316a9d748588c5435216f6ce · Patch
• https://osv.dev/vulnerability/CVE-2011-1178 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0837.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1178 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201209-23.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0838.html · Vendor Advisory
• http://securityfocus.com/bid/48057 · Note
• https://access.redhat.com/security/cve/CVE-2011-1178 · Note
• https://access.redhat.com/errata/RHSA-2011:0837 · Note
• https://access.redhat.com/security/cve/CVE-2010-4540 · Note
• https://access.redhat.com/security/cve/CVE-2010-4541 · Note