856283 – (CVE-2022-32990) <media-gfx/gimp-2.10.32: DoS via crafted XCF file

Bug 856283 (CVE-2022-32990) - <media-gfx/gimp-2.10.32: DoS via crafted XCF file

Summary: <media-gfx/gimp-2.10.32: DoS via crafted XCF file

Status:	IN_PROGRESS

Alias:	CVE-2022-32990

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://gitlab.gnome.org/GNOME/gimp/-...
Whiteboard:	B3 [glsa?]
Keywords:	PullRequest

Depends on:	856790
Blocks:
	Show dependency tree

Reported:	2022-07-03 17:13 UTC by John Helmert III
Modified:	2022-07-11 22:58 UTC (History)
CC List:	2 users (show)

See Also:	https://github.com/gentoo/gentoo/pull/26355
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-07-03 17:13:29 UTC

CVE-2022-32990:

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).

Patches seem to be in 2.10.32: https://gitlab.gnome.org/GNOME/gimp/-/commit/6ab90ecbbd7cc95901933f62227fd140c0576d55
https://gitlab.gnome.org/GNOME/gimp/-/commit/e7d4b580e514029f28dc9bd59c66187e166db47c

Please stabilize 2.10.32.

Comment 1 Sergey Torokhov 2022-07-07 06:20:49 UTC

Stable request: https://bugs.gentoo.org/856790

Comment 2 Larry the Git Cow gentoo-dev

2022-07-11 22:50:08 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=180e767499a9434ebbee66cab692bdc5c0278f98

commit 180e767499a9434ebbee66cab692bdc5c0278f98
Author:     Sergey Torokhov <torokhov-s-a@yandex.ru>
AuthorDate: 2022-07-11 21:24:09 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-07-11 22:48:01 +0000

    media-gfx/gimp: cleanup CVEs affected 2.10.28, 2.10.30
    
    Bug: https://bugs.gentoo.org/845402
    Bug: https://bugs.gentoo.org/856283
    
    Signed-off-by: Sergey Torokhov <torokhov-s-a@yandex.ru>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 media-gfx/gimp/Manifest               |   2 -
 media-gfx/gimp/gimp-2.10.28-r1.ebuild | 211 ----------------------------------
 media-gfx/gimp/gimp-2.10.30.ebuild    | 211 ----------------------------------
 3 files changed, 424 deletions(-)

Comment 3 John Helmert III archtester

2022-07-11 22:58:29 UTC

Thanks!