Fedora 27 update for gimp



| Updated: 2025-04-24
Risk Medium
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2017-17784
CVE-2017-17785
CVE-2017-17786
CVE-2017-17787
CVE-2017-17788
CVE-2017-17789
CWE-ID CWE-125
CWE-119
CWE-126
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 Fedora
Operating systems & Components / Operating system

gimp
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Out-of-bounds read

EUVDB-ID: #VU33233

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-17784

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in load_image in plug-ins/common/file-gbr.c in the gbr import parser, related to mishandling of UTF-8 data. A remote attacker can perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 27

gimp: before 2.8.22-3.fc27

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2018-67b75f73fa


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU33234

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-17785

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 27

gimp: before 2.8.22-3.fc27

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2018-67b75f73fa


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer over-read

EUVDB-ID: #VU10662

Risk: Low

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-17786

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1). A remote attacker can supply an unexpected bits-per-pixel value for an RGBA image and perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 27

gimp: before 2.8.22-3.fc27

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2018-67b75f73fa


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Out-of-bounds read

EUVDB-ID: #VU33235

Risk: Medium

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-17787

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c. A remote attacker can perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 27

gimp: before 2.8.22-3.fc27

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2018-67b75f73fa


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU33238

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-17788

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '' character after the version string. A remote attacker can perform a denial of service attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 27

gimp: before 2.8.22-3.fc27

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2018-67b75f73fa


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU33216

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-17789

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

In GIMP 2.8.22, there is a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 27

gimp: before 2.8.22-3.fc27

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2018-67b75f73fa


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###