Published: 12/07/2016 Updated: 12/02/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 606

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote malicious users to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gimp gimp

Debian Bug report logs - #828179 gimp: CVE-2016-4994: Use-after-free vulnerabilities in the channel and layer properties parsing process Package: src:gimp; Maintainer for src:gimp is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sa ...

GIMP could be made to crash or run programs as your login if it opened a specially crafted file ...

Shmuel H discovered that GIMP, the GNU Image Manipulation Program, is prone to a use-after-free vulnerability in the channel and layer properties parsing process when loading a XCF file An attacker can take advantage of this flaw to potentially execute arbitrary code with the privileges of the user running GIMP if a specially crafted XCF file is p ...

Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files An attacker could create a specially crafted XCF file which could cause GIMP to crash ...

CWE-416 http://lists.opensuse.org/opensuse-updates/2016-07/msg00005.html http://www.debian.org/security/2016/dsa-3612 http://www.ubuntu.com/usn/USN-3025-1 https://bugzilla.gnome.org/show_bug.cgi?id=767873 https://git.gnome.org/browse/gimp/commit/?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f http://www.securitytracker.com/id/1036226 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.431987 http://www.securityfocus.com/bid/91425 http://rhn.redhat.com/errata/RHSA-2016-2589.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828179 https://usn.ubuntu.com/3025-1/https://nvd.nist.gov

CVE-2016-4994

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect