PT-2012-6333 · Gimp+3 · Libgimpprint+5

Marc Schönefeld · Published 1970-01-01 · Updated 2023-02-13 · CVE-2012-4405

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libgimpprint versions (affected versions not specified) libgimpprint-devel versions (affected versions not specified) libgimpprint-debuginfo versions (affected versions not specified)

Description The issue is related to the exploitation of a vulnerability in the libgimpprint package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. This vulnerability can be exploited remotely. Additionally, there are multiple integer underflows in the icmLut allocate function in the International Color Consortium (ICC) Format library, which can cause a denial of service and possibly execute arbitrary code via crafted PostScript or PDF files with embedded images.

Recommendations For libgimpprint, consider disabling the vulnerable package until a patch is available. For libgimpprint-devel, restrict access to the vulnerable package to minimize the risk of exploitation. For libgimpprint-debuginfo, avoid using the package until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-04375

BDU:2015-04376

BDU:2015-05499

BDU:2015-05500

BDU:2015-05501

CESA-2012_1256

CVE-2012-4405

DSA-2595-1

OPENSUSE-SU-2012_1289-1

RHSA-2012:1256

RHSA-2012_1256

SUSE-SU-2012_1222-1

Affected Products

Centos

Red Hat

Suse

Libgimpprint

Libgimpprint-Debuginfo

Libgimpprint-Devel

References · 40

• http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00001.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:090 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201412-17.xml · Vendor Advisory
• http://ubuntu.com/usn/USN-1581-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04375 · Security Note
• http://rhn.redhat.com/errata/RHSA-2012-1256.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-10/msg00015.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4405 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00031.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05499 · Security Note
• https://bdu.fstec.ru/vul/2015-05500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4405 · Security Note
• https://linux.oracle.com/errata/ELSA-2012-1256.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4405 · Security Note
• https://osv.dev/vulnerability/CVE-2012-4405 · Vendor Advisory