DSA-1335-1 gimp -- several vulnerabilities

Debian Security Advisory

DSA-1335-1 gimp -- several vulnerabilities

Date Reported:

18 Jul 2007

Affected Packages:

gimp

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2006-4519, CVE-2007-2949.

More information:

Several remote vulnerabilities have been discovered in Gimp, the GNU Image Manipulation Program, which might lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems:

• CVE-2006-4519

  Sean Larsson discovered several integer overflows in the processing code for DICOM, PNM, PSD, RAS, XBM and XWD images, which might lead to the execution of arbitrary code if a user is tricked into opening such a malformed media file.

• CVE-2007-2949

  Stefan Cornelius discovered an integer overflow in the processing code for PSD images, which might lead to the execution of arbitrary code if a user is tricked into opening such a malformed media file.

For the oldstable distribution (sarge) these problems have been fixed in version 2.2.6-1sarge4. Packages for mips and mipsel are not yet available.

For the stable distribution (etch) these problems have been fixed in version 2.2.13-1etch4. Packages for mips are not yet available.

For the unstable distribution (sid) these problems have been fixed in version 2.2.17-1.

We recommend that you upgrade your gimp packages.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Source:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4.dsc

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4.diff.gz

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/g/gimp/gimp-data_2.2.6-1sarge4_all.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp1.2_2.2.6-1sarge4_all.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-doc_2.2.6-1sarge4_all.deb

Alpha:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_arm.deb

HPPA:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_ia64.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_m68k.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_m68k.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_m68k.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_m68k.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_m68k.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_m68k.deb

PowerPC:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.6-1sarge4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.6-1sarge4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.6-1sarge4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.6-1sarge4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.6-1sarge4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.6-1sarge4_sparc.deb

Debian GNU/Linux 4.0 (etch)

Source:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4.dsc

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4.diff.gz

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/g/gimp/gimp-data_2.2.13-1etch4_all.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-doc_2.2.13-1etch4_all.deb

Alpha:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_alpha.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_amd64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_arm.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_arm.deb

HPPA:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_hppa.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_i386.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_ia64.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_ia64.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_mipsel.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_mipsel.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_mipsel.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_mipsel.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_mipsel.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_mipsel.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_powerpc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_s390.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/g/gimp/gimp_2.2.13-1etch4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-dbg_2.2.13-1etch4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-helpbrowser_2.2.13-1etch4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-python_2.2.13-1etch4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/gimp-svg_2.2.13-1etch4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0_2.2.13-1etch4_sparc.deb

http://security.debian.org/pool/updates/main/g/gimp/libgimp2.0-dev_2.2.13-1etch4_sparc.deb

MD5 checksums of the listed files are available in the original advisory.