REDHAT-BUG-2547461: Medium severity GIMP GNU Image Manipulation Program vulnerability
Finding 7. plug-ins/common/hot.c, pluginCore() (~429–443, 618). Same wrapped allocation vs internal/GEGL consumer extent. ASan WRITE. Vector: apply Hot filter on oversized image (filter path, not file parser). CVSS tentative: 6.3 (AC:H).
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs to cause the Hot filter to be applied to an oversized image. The issue is in the filter-processing path rather than a file parser, and the tentative CVSS assessment lists attack complexity as high.
Does simply opening a malicious image trigger the vulnerability?
The available information identifies the Hot filter path as the vector and explicitly distinguishes it from a file parser. It does not indicate that merely opening an image is sufficient.
What is the observed impact when the issue is triggered?
The finding reports an AddressSanitizer-detected write caused by a wrapped allocation that is smaller than the extent consumed internally by GEGL.