Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 432582 (CVE-2012-3402) - <media-gfx/gimp-2.2.14 : Heap-buffer overflow by decoding certain PSD headers (CVE-2012-3402)
Summary: <media-gfx/gimp-2.2.14 : Heap-buffer overflow by decoding certain PSD headers...
Alias: CVE-2012-3402
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa]
Depends on:
Reported: 2012-08-24 11:56 UTC by Agostino Sarubbo
Modified: 2012-09-28 11:43 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2012-08-24 11:56:24 UTC
From oss-security:

A heap-based buffer overflow flaw was found in the way Adobe Photoshop(tm) PSD plug-in
of Gimp, the GNU Image Manipulation Program, performed decoding of headers, when loading
certain Adobe Photoshop image files. A remote attacker could provide a specially-crafted
PSD image file that, when opened in Gimp would lead to PSD plug-in crash or, potentially,
arbitrary code execution with the privileges of the user running gimp executable.

Note: A different flaw than CVE-2009-3909.

CVSSv2: 6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected versions: X <= 2.2.13
                   Newer versions (gimp-v2.6.X, gimp-v2.8.X, master) are not affected
                   by this issue.
Comment 1 Agostino Sarubbo gentoo-dev 2012-08-24 11:57:00 UTC
@security, if it is fine for you, go to glsa.
Comment 2 Sean Amoss (RETIRED) gentoo-dev Security 2012-08-24 18:51:41 UTC
I'll add it to the existing GLSA draft this time, but users applying either of the two previous GIMP GLSA's have already been protected from this issue.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2012-08-27 07:47:48 UTC
CVE-2012-3402 (
  Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin
  in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of
  service and possibly execute arbitrary code via a crafted channels header
  value in a PSD image file, which triggers a heap-based buffer overflow, a
  different vulnerability than CVE-2009-3909.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2012-09-28 11:43:25 UTC
This issue was resolved and addressed in
 GLSA 201209-23 at
by GLSA coordinator Sean Amoss (ackle).