REDHAT-BUG-2525612: Medium severity GIMP file-ico plugin vulnerability
A flaw was found in the file-ico plugin in GIMP, affecting all versions. When processing a specially crafted ICO image file, the plugin does not properly validate the usedclrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
All versions of GIMP are affected when the file-ico plugin is present and processes ICO image files.
What does exploitation require?
An attacker needs to cause GIMP to process a specially crafted ICO image whose used_clrs palette-count parameter triggers the plugin's insufficient bounds validation.
What is the likely impact?
The flaw can cause an application crash, resulting in denial of service. It may also allow limited disclosure of heap memory contents through a heap out-of-bounds read.