CVE-2013-1978: Buffer Overflow
Heap-based buffer overflow in the readxwdcols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries.
Other sources
Murray McAllister of the Red Hat Security Response Team has discovered a heap-based buffer overflow in the way GIMP, the GNU Image Manipulation Program, performed loading of certain X Window System (XWD) image dumps containing a small number of color map entries but a large number of colors. A remote attacker could provide a specially-crafted XWD format image file that, when processed, would lead to gimp XWD plug-in crash or, potentially, arbitrary code execution with the privileges of the user running the gimp executable.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1978?
CVE-2013-1978 is rated as a high severity vulnerability due to the potential for arbitrary code execution and denial of service.
How do I fix CVE-2013-1978?
To fix CVE-2013-1978, update GIMP to version 2.8.0 or later.
What are the consequences of exploiting CVE-2013-1978?
Exploitation of CVE-2013-1978 can lead to a denial of service and the execution of arbitrary code.
Which versions of GIMP are affected by CVE-2013-1978?
GIMP versions prior to 2.6.9 are affected by CVE-2013-1978.
Are there any workarounds for CVE-2013-1978?
Currently, the best workaround for CVE-2013-1978 is to disable the XWD plugin in GIMP until an update is applied.