From oss-security: escription: A heap-based buffer overflow flaw was found in the way Adobe Photoshop(tm) PSD plug-in of Gimp, the GNU Image Manipulation Program, performed decoding of headers, when loading certain Adobe Photoshop image files. A remote attacker could provide a specially-crafted PSD image file that, when opened in Gimp would lead to PSD plug-in crash or, potentially, arbitrary code execution with the privileges of the user running gimp executable. Note: A different flaw than CVE-2009-3909. CVSSv2: 6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P Affected versions: X <= 2.2.13 Newer versions (gimp-v2.6.X, gimp-v2.8.X, master) are not affected by this issue.
@security, if it is fine for you, go to glsa.
I'll add it to the existing GLSA draft this time, but users applying either of the two previous GIMP GLSA's have already been protected from this issue.
CVE-2012-3402 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3402): Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted channels header value in a PSD image file, which triggers a heap-based buffer overflow, a different vulnerability than CVE-2009-3909.
This issue was resolved and addressed in GLSA 201209-23 at http://security.gentoo.org/glsa/glsa-201209-23.xml by GLSA coordinator Sean Amoss (ackle).