REDHAT-BUG-2507475: Buffer Overflow
A flaw was found in the file-fits plugin in GIMP, affecting all versions. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2507475?
The severity of REDHAT-BUG-2507475 is classified as high, with a score of 7.
How do I fix REDHAT-BUG-2507475?
To fix REDHAT-BUG-2507475, update to the latest version of GIMP that contains the security patch addressing this vulnerability.
What type of vulnerability is REDHAT-BUG-2507475?
REDHAT-BUG-2507475 is an integer overflow vulnerability that can lead to a buffer overflow in GIMP's file-fits plugin.
Which versions of GIMP are affected by REDHAT-BUG-2507475?
All versions of GIMP are affected by REDHAT-BUG-2507475 due to the flawed file-fits plugin.
What are the potential impacts of exploiting REDHAT-BUG-2507475?
Exploiting REDHAT-BUG-2507475 can lead to application crashes, data corruption, or remote code execution.