Articles / Ubuntu: Security update for…

Ubuntu: Security update for GIMP

Joseph Sheridan discovered that GIMP incorrectly handled certain malformed headers in FIT files. If a user were tricked into opening a specially crafted FIT image file, an attacker could cause GIMP to crash. Murray McAllister discovered that GIMP incorrectly handled malformed KiSS palette files. If a user were tricked into opening a specially crafted KiSS palette file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user’s privileges. Matthias Weckbecker discovered that GIMP incorrectly handled malformed GIF image files. If a user were tricked into opening a specially crafted GIF image file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user’s privileges.

Updated packages are available from security.ubuntu.com.

==========================================================================
Ubuntu Security Notice USN-1559-1
September 10, 2012

gimp vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

GIMP could be made to crash or run programs as your login if it opened a
specially crafted file.

Software Description:
- gimp: The GNU Image Manipulation Program

Details:

Joseph Sheridan discovered that GIMP incorrectly handled certain malformed
headers in FIT files. If a user were tricked into opening a specially
crafted FIT image file, an attacker could cause GIMP to crash.
(CVE-2012-3236)

Murray McAllister discovered that GIMP incorrectly handled malformed KiSS
palette files. If a user were tricked into opening a specially crafted KiSS
palette file, an attacker could cause GIMP to crash, or possibly execute
arbitrary code with the user's privileges. (CVE-2012-3403)

Matthias Weckbecker discovered that GIMP incorrectly handled malformed GIF
image files. If a user were tricked into opening a specially crafted GIF
image file, an attacker could cause GIMP to crash, or possibly execute
arbitrary code with the user's privileges. (CVE-2012-3481)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
 gimp                            2.6.12-1ubuntu1.1

Ubuntu 11.10:
 gimp                            2.6.11-2ubuntu4.1

Ubuntu 11.04:
 gimp                            2.6.11-1ubuntu6.3

Ubuntu 10.04 LTS:
 gimp                            2.6.8-2ubuntu1.5

In general, a standard system update will make all the necessary changes.

References:
 http://www.ubuntu.com/usn/usn-1559-1
 CVE-2012-3236, CVE-2012-3403, CVE-2012-3481

Package Information:
 https://launchpad.net/ubuntu/+source/gimp/2.6.12-1ubuntu1.1
 https://launchpad.net/ubuntu/+source/gimp/2.6.11-2ubuntu4.1
 https://launchpad.net/ubuntu/+source/gimp/2.6.11-1ubuntu6.3
 https://launchpad.net/ubuntu/+source/gimp/2.6.8-2ubuntu1.5
Screenshot

Project Spotlight

Kigo Video Converter Ultimate for Mac

A tool for converting and editing videos.

Screenshot

Project Spotlight

Kid3

An efficient tagger for MP3, Ogg/Vorbis, and FLAC files.