REDHAT-BUG-2534282: Buffer Overflow
A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photoshop Document) image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a heap-based buffer overflow when the image data is decoded. This buffer overflow corrupts adjacent heap objects, allowing for a controlled memory write that can result in an application crash or arbitrary code execution.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger this flaw?
An attacker must provide a specially crafted PSD image containing an embedded JPEG header with values that cause an integer overflow. The issue is triggered when GIMP generates a thumbnail preview for that file.
What impact could successful exploitation have?
The undersized heap allocation can lead to a heap-based buffer overflow that corrupts adjacent heap objects. This may cause GIMP to crash or may allow arbitrary code execution.