CVE-2017-17789: Buffer Overflow

Reference Links

• http://www.openwall.com/lists/oss-security/2017/12/19/5
• https://bugzilla.gnome.org/show_bug.cgi?id=790849
• https://www.debian.org/security/2017/dsa-4077
• https://lists.debian.org/debian-lts-announce/2017/12/msg00023.html
• https://usn.ubuntu.com/3539-1/
• http://www.securityfocus.com/bid/102898
• https://launchpad.net/bugs/cve/CVE-2017-17789
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17789
• https://git.gnome.org/browse/GIMP/commit/?id=28e95fbeb5720e6005a088fa811f5bf3c1af48b8 (master)
• https://git.gnome.org/browse/GIMP/commit/?id=01898f10f87a094665a7fdcf7153990f4e511d3f (gimp-2-8)
• https://ubuntu.com/security/notices/USN-3539-1
• https://nvd.nist.gov/vuln/detail/CVE-2017-17789
• https://security-tracker.debian.org/tracker/CVE-2017-17789
• https://ubuntu.com/security/CVE-2017-17789
• https://www.freexian.com/services/debian-lts.html
• https://debian-handbook.info/get/
• https://security-tracker.debian.org/tracker/CVE-2017-17786
• https://security-tracker.debian.org/tracker/CVE-2017-17784
• https://security-tracker.debian.org/tracker/CVE-2017-17787
• https://security-tracker.debian.org/tracker/CVE-2017-17785
• https://security-tracker.debian.org/tracker/CVE-2017-17788
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884837
• https://git.gnome.org/browse/GIMP/commit/?id=28e95fbeb5720e6005a088fa811f5bf3c1af48b8
• https://git.gnome.org/browse/GIMP/commit/?id=01898f10f87a094665a7fdcf7153990f4e511d3f

Parent vulnerabilities

(Appears in the following advisories)

• USN-3539-1

Frequently Asked Questions

• What is CVE-2017-17789?

  CVE-2017-17789 is a vulnerability in GIMP 2.8.22 that allows a heap-based buffer overflow in read_channel_data in plug-ins/common/file-psp.c.

• What is the severity of CVE-2017-17789?

  The severity of CVE-2017-17789 is high with a CVSS score of 7.8.

• How does CVE-2017-17789 impact GIMP?

  CVE-2017-17789 can potentially lead to a heap-based buffer overflow, which may allow attackers to execute arbitrary code or cause a denial of service on an affected system running GIMP 2.8.22.

• Which versions of GIMP are affected by CVE-2017-17789?

  GIMP versions 2.8.22 and below are affected by CVE-2017-17789.

• How can I fix the CVE-2017-17789 vulnerability in GIMP?

  To fix the CVE-2017-17789 vulnerability in GIMP, it is recommended to upgrade to version 2.10.8 or later, or apply the specific remedies mentioned for your operating system and package manager.