REDHAT-BUG-2533005: High severity GIMP vulnerability
A flaw was found in GIMP's Lighting Effects filter. When loading a lighting preset file, lighting-ui.c reads the number of light sources from the file using fscanf() without validating the return value or bounding the parsed count against the fixed-size array of light sources (NUMLIGHTS, 6 entries). A preset file specifying more than 6 light sources causes writes past the end of the lightsource array, corrupting memory. This issue could be triggered by convincing a user to open a specially crafted lighting preset file in GIMP, potentially leading to a crash or arbitrary code execution in the context of the user running GIMP.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
GIMP users who load lighting preset files are exposed. The flaw is triggered through a specially crafted preset file rather than by ordinary use alone.
What must an attacker do to exploit it?
An attacker must convince a user to open a crafted Lighting Effects preset file in GIMP. Successful exploitation may crash GIMP or allow code execution with the privileges of the user running it.