NASLDB: Scientific Linux Security Update : gimp on SL6.x i386/x86_64
General
ID: 61606
Name: Scientific Linux Security Update : gimp on SL6.x i386/x86_64
Summary: Checks rpm output for the updated packages
Credits: Tenable Network Security, Inc.
Classification
Risk: –
CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Temporal Vector: –
Port: 0
Family: Scientific Linux Local Security Checks
Type: Local
Description
The GIMP (GNU Image Manipulation Program) is an image composition and
editing program.
An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the GIMP’s GIF image format plug-in. An attacker could create
a specially-crafted GIF image file that, when opened, could cause the
GIF plug-in to crash or, potentially, execute arbitrary code with the
privileges of the user running the GIMP. (CVE-2012-3481)
A heap-based buffer overflow flaw was found in the Lempel-Ziv-Welch
(LZW) decompression algorithm implementation used by the GIMP’s GIF
image format plug-in. An attacker could create a specially-crafted GIF
image file that, when opened, could cause the GIF plug-in to crash or,
potentially, execute arbitrary code with the privileges of the user
running the GIMP. (CVE-2011-2896)
A heap-based buffer overflow flaw was found in the GIMP’s KiSS CEL
file format plug-in. An attacker could create a specially-crafted KiSS
palette file that, when opened, could cause the CEL plug-in to crash
or, potentially, execute arbitrary code with the privileges of the
user running the GIMP. (CVE-2012-3403)
Users of the GIMP are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. The GIMP
must be restarted for the update to take effect.
Exploiting
Exploit Available: –
Exploitability Ease: –
Sources
CVE: CVE-2011-2896
OSVDB: –
Bugtraq: –
scipID: –
Timeline
Vulnerability Disclosure: –
Patch Release: 2012/08/20
Plugin Release: 2012/08/21
Plugin
Version: 1.2
Filename: sl_20120820_gimp_on_SL6_x.nasl
Filesize: 4239 bytes
MD5 Hash: 56a4818a0f7ba8cf2767503c62f051da
Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list
Dependencies: "ssh_get_info.nasl"
Copyright: This script is Copyright© 2012 Tenable Network Security, Inc.
- Letzte Plugins
- USN-1611-1 : thunderbird vulnerabilities
- USN-1610-1 : linux vulnerability
- USN-1609-1 : linux-ti-omap4 vulnerability
- SuSE 10 Security Update : PostgreSQL
- RHSA-2012-1364: bind97
- RHSA-2012-1363: bind
- RHSA-2012-1362: thunderbird
- RHSA-2012-1361: xulrunner
- Mandriva Linux Security Advisory : graphicsmagick
- FreeBSD : phpMyAdmin — Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack