what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2012-142

Mandriva Linux Security Advisory 2012-142
Posted Aug 21, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-142 - A heap-based buffer overflow flaw, leading to invalid free, was found in the way KISS CEL file format plug-in of Gimp, the GNU Image Manipulation Program, performed loading of certain palette files. A remote attacker could provide a specially-crafted KISS palette file that, when opened in Gimp would cause the CEL plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the gimp executable. Integer overflow, leading to heap-based buffer overflow flaw was found in the GIMP's GIF image file plug-in. An attacker could create a specially-crafted GIF image file that, when opened, could cause the GIF plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. The updated gimp packages have been upgraded to the 2.6.12 version and patched to correct these issues. Additionally for Mandriva Enterprise server 5 the gegl packages was upgraded to the 0.0.22 version and rebuilt for ffmpeg 0.5.9, the enscript packages was added because of a build dependency, the gutenprint and mtink packages was rebuilt against the gimp 2.6.12 libraries.

tags | advisory, remote, overflow, arbitrary
systems | linux, mandriva
advisories | CVE-2012-3403, CVE-2012-3481
SHA-256 | aec214e418fa063224a016dcb76fa86d1ca6e8c1157010ee36b64648e14af80d

Mandriva Linux Security Advisory 2012-142

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:142
http://www.mandriva.com/security/
_______________________________________________________________________

Package : gimp
Date : August 21, 2012
Affected: 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in gimp:

A heap-based buffer overflow flaw, leading to invalid free, was
found in the way KISS CEL file format plug-in of Gimp, the GNU Image
Manipulation Program, performed loading of certain palette files. A
remote attacker could provide a specially-crafted KISS palette file
that, when opened in Gimp would cause the CEL plug-in to crash or,
potentially, execute arbitrary code with the privileges of the user
running the gimp executable (CVE-2012-3403).

Integer overflow, leading to heap-based buffer overflow flaw was
found in the GIMP's GIF (Graphics Interchange Format) image file
plug-in. An attacker could create a specially-crafted GIF image
file that, when opened, could cause the GIF plug-in to crash or,
potentially, execute arbitrary code with the privileges of the user
running the GIMP (CVE-2012-3481).

The updated gimp packages have been upgraded to the 2.6.12 version
and patched to correct these issues.

Additionally for Mandriva Enterprise server 5 the gegl packages
was upgraded to the 0.0.22 version and rebuilt for ffmpeg 0.5.9,
the enscript packages was added because of a build dependency, the
gutenprint and mtink packages was rebuilt against the gimp 2.6.12
libraries.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3403
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3481
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2011:
6df85e0bd146aad5111cb93b13aa3d3c 2011/i586/gimp-2.6.12-0.1-mdv2011.0.i586.rpm
c33ee12112d91e840acff735814c2332 2011/i586/gimp-python-2.6.12-0.1-mdv2011.0.i586.rpm
b3cee341cd0391530f2234e25c3f3829 2011/i586/libgimp2.0_0-2.6.12-0.1-mdv2011.0.i586.rpm
b9ae9ef5a24742e1230ef2b21cdaf9fe 2011/i586/libgimp2.0-devel-2.6.12-0.1-mdv2011.0.i586.rpm
1b6b4193b5d548d4e15715266bf47560 2011/SRPMS/gimp-2.6.12-0.1.src.rpm

Mandriva Linux 2011/X86_64:
9f683f9345ffead8bdb51be9db90146e 2011/x86_64/gimp-2.6.12-0.1-mdv2011.0.x86_64.rpm
a8de76aab2e7ce6338fd9f967b998e9c 2011/x86_64/gimp-python-2.6.12-0.1-mdv2011.0.x86_64.rpm
52543a7c6db50902d3ca73b10075ffb7 2011/x86_64/lib64gimp2.0_0-2.6.12-0.1-mdv2011.0.x86_64.rpm
6ca3008f8cb920bfa3bae50d6fd6a232 2011/x86_64/lib64gimp2.0-devel-2.6.12-0.1-mdv2011.0.x86_64.rpm
1b6b4193b5d548d4e15715266bf47560 2011/SRPMS/gimp-2.6.12-0.1.src.rpm

Mandriva Enterprise Server 5:
adfd583395e293e65eb9bdc01411b66a mes5/i586/enscript-1.6.4-8.2mdvmes5.2.i586.rpm
d66cc2ba6f8243e00eb066d1c3358145 mes5/i586/gegl-0.0.22-0.1mdvmes5.2.i586.rpm
d890ec13a8981fe618bf6ba7f6a662e5 mes5/i586/gimp-2.6.12-0.1mdvmes5.2.i586.rpm
d89b715a1b588006d8876c18da78d3c4 mes5/i586/gimp-python-2.6.12-0.1mdvmes5.2.i586.rpm
4238c650ca3f88169008c15813fffc97 mes5/i586/gutenprint-common-5.2.3-0.3mdvmes5.2.i586.rpm
90cf02d5e29adb704ab063d50c0c6ec2 mes5/i586/gutenprint-cups-5.2.3-0.3mdvmes5.2.i586.rpm
7e1bdf5b099770184c5206a5ea1a4169 mes5/i586/gutenprint-escputil-5.2.3-0.3mdvmes5.2.i586.rpm
91c4d10340291be5af1d161d75510bdb mes5/i586/gutenprint-foomatic-5.2.3-0.3mdvmes5.2.i586.rpm
20fcd1e4e30c918b3fae7b9bf894e983 mes5/i586/gutenprint-gimp2-5.2.3-0.3mdvmes5.2.i586.rpm
bc7aebfd12c6810a6dbf78e555ae27c9 mes5/i586/gutenprint-ijs-5.2.3-0.3mdvmes5.2.i586.rpm
95bb0625b0bb3cb309566cf7feffc5ed mes5/i586/libgegl0-0.0.22-0.1mdvmes5.2.i586.rpm
eac4476ae3c38d6779fe70c30661e132 mes5/i586/libgegl-devel-0.0.22-0.1mdvmes5.2.i586.rpm
d31b196dd6a62bf611285bef72f8b8ed mes5/i586/libgimp2.0_0-2.6.12-0.1mdvmes5.2.i586.rpm
016ae0eaa31501c90bb91d7e47cc807b mes5/i586/libgimp2.0-devel-2.6.12-0.1mdvmes5.2.i586.rpm
453bb3526f6fcf2a8538d08564b8a904 mes5/i586/libgutenprint2-5.2.3-0.3mdvmes5.2.i586.rpm
326394d81a3eabf6d41d296a6b7b8d58 mes5/i586/libgutenprint2-devel-5.2.3-0.3mdvmes5.2.i586.rpm
114e245beba24c9f7ff3d024853950e9 mes5/i586/libgutenprintui2_1-5.2.3-0.3mdvmes5.2.i586.rpm
4a273b1c580b0e23c1f47cf62f3e0535 mes5/i586/libgutenprintui2_1-devel-5.2.3-0.3mdvmes5.2.i586.rpm
5c38d85ad6d379de351906089caa9881 mes5/i586/mtink-1.0.14-14.2mdvmes5.2.i586.rpm
a993266194594b6b7951c05ed4790d9d mes5/SRPMS/enscript-1.6.4-8.2mdvmes5.2.src.rpm
9078b3e6d4fdd8755b533599c91ad1c0 mes5/SRPMS/gegl-0.0.22-0.1mdvmes5.2.src.rpm
adaa780385959b892bc7cc2c1a3e6f7f mes5/SRPMS/gimp-2.6.12-0.1mdvmes5.2.src.rpm
324a98ab9ac0c772bd8c52b57ea14a2d mes5/SRPMS/gutenprint-5.2.3-0.3mdvmes5.2.src.rpm
97b94cadb79f40ac930f71443e0b9e29 mes5/SRPMS/mtink-1.0.14-14.2mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
ce1f98f921ac74975d6b609032fbb9eb mes5/x86_64/enscript-1.6.4-8.2mdvmes5.2.x86_64.rpm
7bb75619775c9fcb79969301d9b83646 mes5/x86_64/gegl-0.0.22-0.1mdvmes5.2.x86_64.rpm
bc79556d1d5abc375652b40ce711ac04 mes5/x86_64/gimp-2.6.12-0.1mdvmes5.2.x86_64.rpm
0bca1d205b8f692896fa6e68340a4444 mes5/x86_64/gimp-python-2.6.12-0.1mdvmes5.2.x86_64.rpm
1264a7e67c082297d69d04dd43895cd8 mes5/x86_64/gutenprint-common-5.2.3-0.3mdvmes5.2.x86_64.rpm
53bda658df6540665264ecc1ed9ff6da mes5/x86_64/gutenprint-cups-5.2.3-0.3mdvmes5.2.x86_64.rpm
295ac9156ffee42a512713b6aec8da36 mes5/x86_64/gutenprint-escputil-5.2.3-0.3mdvmes5.2.x86_64.rpm
633e8ab8d476e440d64baa4b47012563 mes5/x86_64/gutenprint-foomatic-5.2.3-0.3mdvmes5.2.x86_64.rpm
d405f95ade321b610f1c44bbf805f5b1 mes5/x86_64/gutenprint-gimp2-5.2.3-0.3mdvmes5.2.x86_64.rpm
8d2ccdf35f159b69c44fd84c5f5c00b1 mes5/x86_64/gutenprint-ijs-5.2.3-0.3mdvmes5.2.x86_64.rpm
6f8164ef693858736f2aec38f31cb9c8 mes5/x86_64/lib64gegl0-0.0.22-0.1mdvmes5.2.x86_64.rpm
01f465095a4f2a0e8533008d45dbc08d mes5/x86_64/lib64gegl-devel-0.0.22-0.1mdvmes5.2.x86_64.rpm
72e57d27a953c8e09fc9748cb18f9a86 mes5/x86_64/lib64gimp2.0_0-2.6.12-0.1mdvmes5.2.x86_64.rpm
88bfb7f493111df29efa7e1b22ca72fb mes5/x86_64/lib64gimp2.0-devel-2.6.12-0.1mdvmes5.2.x86_64.rpm
07d38077acd65da67c9ebb95b828a20b mes5/x86_64/lib64gutenprint2-5.2.3-0.3mdvmes5.2.x86_64.rpm
bfb316021e3c3896ef6c3daab6684008 mes5/x86_64/lib64gutenprint2-devel-5.2.3-0.3mdvmes5.2.x86_64.rpm
55a465cb018c4dc97ede038dabc3d1ff mes5/x86_64/lib64gutenprintui2_1-5.2.3-0.3mdvmes5.2.x86_64.rpm
e2217d76b94bb47e952957bcffbd3227 mes5/x86_64/lib64gutenprintui2_1-devel-5.2.3-0.3mdvmes5.2.x86_64.rpm
420aff1280ab464d40aea0b5b75d44af mes5/x86_64/mtink-1.0.14-14.2mdvmes5.2.x86_64.rpm
a993266194594b6b7951c05ed4790d9d mes5/SRPMS/enscript-1.6.4-8.2mdvmes5.2.src.rpm
9078b3e6d4fdd8755b533599c91ad1c0 mes5/SRPMS/gegl-0.0.22-0.1mdvmes5.2.src.rpm
adaa780385959b892bc7cc2c1a3e6f7f mes5/SRPMS/gimp-2.6.12-0.1mdvmes5.2.src.rpm
324a98ab9ac0c772bd8c52b57ea14a2d mes5/SRPMS/gutenprint-5.2.3-0.3mdvmes5.2.src.rpm
97b94cadb79f40ac930f71443e0b9e29 mes5/SRPMS/mtink-1.0.14-14.2mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFQM4KJmqjQ0CJFipgRAib9AJ99hkTs6tnjVSPs4vhVan9JoFakZQCeJgZu
EYy4NCsp0eQx4uP2I2zoQ/4=
=1VeY
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close