Changes between Initial Version and Version 2 of Ticket #8072


Ignore:
Timestamp:
07/16/2016 10:50:06 PM (8 years ago)
Author:
Douglas R. Reno
Comment:

Released to fix a Use-after-free vuln in the xcf_load_image function. Can cause a DoS (program carsh) or execute arbitrary code via a crafted XCF file.

CVE-2016-4494

Marked at a 7.8 HIGH by the NVD.

Will try to have this one done by the time I am done tonight.

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #8072

    • Property Owner changed from blfs-book@… to Douglas R. Reno
    • Property Status new → assigned
    • Property Priority normal → highest

  • Ticket #8072 – Description

    initial v2  
    11New point version
     2
     3
     4{{{
     5
     6
     7We are releasing GIMP 2.8.18 to fix a vulnerability in the XCF loading code (CVE-2016-4994). With special XCF files, GIMP can be caused to crash, and possibly be made to execute arbitrary code provided by the attacker.
     8
     9This release includes additional bug fixes since 2.8.16. An important change has happened to the initial startup experience on Microsoft Windows and OS X platforms - any “GIMP is not responding” errors encountered there should be gone.
     10
     11The source code for GIMP 2.8.18 is available from our downloads page; pre-built packages for Microsoft Windows and OS X will follow shortly.
     12}}}
     13
     14
     15{{{
     16Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
     17}}}
     18
     19
     20{{{
     21Impact
     22CVSS Severity (version 3.0):
     23CVSS v3 Base Score: 7.8 High
     24Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
     25Impact Score: 5.9
     26Exploitability Score: 1.8
     27CVSS Version 3 Metrics:
     28Attack Vector (AV): Local
     29Attack Complexity (AC): Low
     30Privileges Required (PR): None
     31User Interaction (UI): Required
     32Scope (S): Unchanged
     33Confidentiality (C): High
     34Integrity (I): High
     35Availability (A): High
     36}}}