Several stack-based buffer overflows were found in the way gimp processes plug-in configuration files. An attacker could create a a specially-crafted plug-in configuration file and trick the local, unsuspecting user into opening it, which could lead to gimp to crash the plugin or, potentially , arbitrary code execution with the privileges of the user running the executable.
Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497
Public PoC: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=gimp-overflows-poc-in-cobol.cob;att=1;bug=608497
Flaw severity note: On systems with compile time buffer checks (FORTIFYSOURCE) feature enabled, the impact of this flaw is mitigated to be only crash.
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4542 to the following vulnerability:
Stack-based buffer overflow in the gfigreadparametergimprgb function in plug-ins/gfig/gfig-style.c in the GFIG plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long Foreground field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself. NOTE: some of these details are obtained from third party information.
References: [1] http://openwall.com/lists/oss-security/2011/01/03/2 [2] http://openwall.com/lists/oss-security/2011/01/04/7 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497 [4] https://bugzilla.redhat.com/showbug.cgi?id=666793 [5] http://osvdb.org/70283 [6] http://secunia.com/advisories/42771 [7] http://www.vupen.com/english/advisories/2011/0016
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-4543 to the following vulnerability:
Heap-based buffer overflow in the readchanneldata function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSPCOMPRLE (aka RLE compression) image file that begins a long run count at the end of the image. NOTE: some of these details are obtained from third party information.
References: [1] http://openwall.com/lists/oss-security/2011/01/03/2 [2] http://openwall.com/lists/oss-security/2011/01/04/7 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497 [4] https://bugzilla.redhat.com/showbug.cgi?id=666793 [5] http://osvdb.org/70284 [6] http://secunia.com/advisories/42771 [7] http://www.vupen.com/english/advisories/2011/0016
Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long "Number of lights" field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself.
GIF image file format readers in various open source projects are based on the GIF decoder implementation written by David Koblas. This implementation contains a bug in the LZW decompressor, causing it to in correctly handle compressed streams that contain code words that were not yet added to the decompression table. LZW decompression has a special case (a KwKwK string) when code word may match the first free entry in the decompression table. The implementation used in this GIF reading code allows code words not only matching, but also exceeding the first free entry.
This problem is identical to a bug found in BSD compress (CVE-2011-2895, bug #727624), but given the unclear relationship between BSD compress and GIF decoder code bases, separate CVE is used here.
Several projects refer to pbmplus as the source form where GIF reading code was taken:
http://www.acme.com/software/pbmplus/
In pbmplus version of the code, the flaw can be found in LWZReadByte():
if (code >= maxcode) { sp++ = firstcode; code = oldcode; }
This allows creating a loop in the decompression table, which leads to an "infinite" loop:
while (code >= clearcode) { sp++ = table[1][code]; if (code == table[0][code]) pmerror("circular table entry BIG ERROR"); code = table[0][code]; }
where:
#define MAXLWZBITS 12 static int table[2][(1<< MAXLWZBITS)]; static int stack[(1<<(MAXLWZBITS))2], sp; sp = stack;
This results in stack[] buffer overflow. If table[][] is located above stack[], stack[] overflow may further modify decoding table and break infinite loop.
Heap-based buffer overflow in the readchanneldata function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSPCOMPRLE (aka RLE compression) image file that begins a long run count at the end of the image. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4543.