Product:

Gimp

(Gimp)
Repositories https://github.com/GNOME/gimp
#Vulnerabilities 38
Date Id Summary Products Score Patch Annotated
2012-07-12 CVE-2012-2763 Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server. Gimp N/A
2012-07-12 CVE-2012-3236 fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string. Gimp N/A
2012-08-31 CVE-2012-4245 The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command. Gimp N/A
2017-12-20 CVE-2017-17784 In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data. Ubuntu_linux, Debian_linux, Gimp 7.8
2017-12-20 CVE-2017-17785 In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c. Ubuntu_linux, Debian_linux, Gimp 7.8
2017-12-20 CVE-2017-17786 In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image. Ubuntu_linux, Debian_linux, Gimp 7.8
2017-12-20 CVE-2017-17787 In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c. Ubuntu_linux, Debian_linux, Gimp 7.8
2017-12-20 CVE-2017-17788 In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string. Ubuntu_linux, Debian_linux, Gimp 5.5
2017-12-20 CVE-2017-17789 In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c. Ubuntu_linux, Debian_linux, Gimp 7.8
2018-06-24 CVE-2018-12713 GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was intended to be private. Gimp 9.1