PT-2022-6739 · Gimp+9 · Gimp+9

Published 2022-04-25 · Updated 2026-01-02 · CVE-2022-30067

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GIMP versions 2.10.30 through 2.10.30 GIMP version 2.99.10

Description The issue is related to a buffer overflow vulnerability. It can be exploited by a remote attacker using a specially crafted XCF file, which causes the program to allocate a huge amount of memory. This results in insufficient memory or a program crash. The vulnerability is associated with the lack of input validation when copying a buffer.

Recommendations For GIMP version 2.10.30, consider disabling the handling of XCF files until a patch is available. For GIMP version 2.99.10, restrict access to the XCF file processing module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

ALSA-2022:7978

ALT-PU-2022-2049

ALT-PU-2023-1087

ALT-PU-2024-15193

ALT-PU-2025-8344

BDU:2023-03844

CVE-2022-30067

DLA-3659-1

DLA-4431-1

MGASA-2022-0219

OPENSUSE-SU-2022_2063-1

OPENSUSE-SU-2022_2619-1

OPENSUSE-SU-2022_2620-1

OPENSUSE-SU-2024:12092-1

RHSA-2022:7978

RHSA-2022_7978

RLSA-2022:7978

SUSE-SU-2022:1889-1

SUSE-SU-2022:2063-1

SUSE-SU-2022:2619-1

SUSE-SU-2022:2620-1

SUSE-SU-2022_1889-1

SUSE-SU-2022_2063-1

SUSE-SU-2022_2619-1

USN-6521-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Debian

Gimp

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 58

• 🔥 https://gitlab.gnome.org/GNOME/gimp/-/issues/8120 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-30067 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6521-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:7978 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32990 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4431-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-44441 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12092-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-44443 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2620-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03844 · Security Note
• https://ubuntu.com/security/notices/USN-6521-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2619-1 · Vendor Advisory