Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 11.04 USN-1147-1 Critical: GIMP Code Execution Threat

ubuntu
Calendar Grey June 13, 2011
Scroller Ubuntu
GIMP flaw permits tailored file processing as user access; refer to USN-1147-1 issued on June 13, 2011 for further information.
GIMP could be made to run programs as your login if it opened a specially crafted file.

Summary

GIMP could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- gimp: The GNU Image Manipulation Program

Details:

Nils Philippsen discovered that GIMP incorrectly handled malformed PSP

image files. If a user were tricked into opening a specially crafted PSP

image file, an attacker could cause GIMP to crash, or possibly execute

arbitrary code with the user's privileges.

Topics%20covered

Topics Covered

security advisory critical code execution ubuntu image processing gimp

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  gimp                            2.6.11-1ubuntu6.1

Ubuntu 10.10:
  gimp                            2.6.10-1ubuntu3.3

Ubuntu 10.04 LTS:
  gimp                            2.6.8-2ubuntu1.3

After a standard system update you need to restart GIMP to make all the
necessary changes.

References

CVE-2011-1782

Severity
critical
Lowest
Low
Medium
High
Critical

June 13, 2011

Topics%20covered

Topics Covered

security advisory critical code execution ubuntu image processing gimp

Package Information

https://launchpad.net/ubuntu/+source/gimp/2.6.11-1ubuntu6.1
https://launchpad.net/ubuntu/+source/gimp/2.6.10-1ubuntu3.3
https://launchpad.net/ubuntu/+source/gimp/2.6.8-2ubuntu1.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.