PT-2017-3731 · Gnu+3 · Gimp+3

Hanno Böck · Published 2017-12-20 · Updated 2022-02-07 · CVE-2017-17788

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: GIMP version 2.8.22

Description: The issue is related to a stack-based buffer over-read in the xcf load stream function, located in app/xcf/xcf.c, which occurs when processing a string without a terminating 0 character. This can potentially allow a remote attacker to cause a denial of service or compromise data integrity and confidentiality.

Recommendations: For GIMP version 2.8.22, consider updating to a newer version that addresses this issue, as no specific fix is provided for this version. As a temporary workaround, restrict the use of the xcf load stream function until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2018-1717

BDU:2018-01593

CVE-2017-17788

DLA-1220-1

DSA-4077-1

MGASA-2018-0030

MGASA-2018-0273

SUSE-SU-2020:0601-1

USN-3539-1

Affected Products

Alt Linux

Gimp

Suse

Ubuntu

References · 61

• https://nvd.nist.gov/vuln/detail/CVE-2017-17788; · Security Note
• https://bdu.fstec.ru/vul/2018-01591 · Security Note
• https://bdu.fstec.ru/vul/2018-01594 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17785 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17789 · Security Note
• https://ubuntu.com/security/CVE-2017-17785 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17788 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17786 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0273 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17786 · Security Note
• https://ubuntu.com/security/CVE-2017-17787 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/gimp · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0601-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-1717 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0273.html · Security Note