CVE-2023-44441
published 2024-05-03CVE-2023-44441: GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…
PriorityP355high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
27.31%
97.8th percentile
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22093.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.10.34-1+deb12u1 (bookworm) | gimp 2.10.34-1+deb12u1 (bookworm) |
| gimp | gimp | < 2.10.36 | 2.10.36 |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.10.22-4+deb11u1 | 2.10.22-4+deb11u1 |
| gimp | gimp | >= 0 < 2.10.34-1+deb12u1 | 2.10.34-1+deb12u1 |
| gimp | gimp | >= 0 < 2.10.36-1 | 2.10.36-1 |
| gimp | gimp | >= 0 < 2.10.36-1 | 2.10.36-1 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
GIMP DDS Plugin vulnerabilities
vendor_ubuntu·2025-01-16
CVE-2023-44441 GIMP DDS Plugin vulnerabilities
Title: GIMP DDS Plugin vulnerabilities
Summary: The GIMP DDS Plugin could be made to crash or run programs as
your login if it opened a specially crafted file.
Jacob Boerema discovered that the GIMP DDS Plugin incorrectly
processed DDS files due to a memory issue. An attacker could
exploit this through a specifically crafted DDS file to cause
GIMP to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
GIMP vulnerabilities
vendor_ubuntu·2023-11-29
CVE-2022-30067 GIMP vulnerabilities
Title: GIMP vulnerabilities
Summary: GIMP could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that GIMP incorrectly handled certain image files. If a
user were tricked into opening a specially crafted image, an attacker could
use this issue to cause GIMP to crash, resulting in a denial of service, or
possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
gimp: dds buffer overflow RCE
vendor_redhat·2023-11-14·CVSS 7.8
CVE-2023-44441 [HIGH] CWE-122 gimp: dds buffer overflow RCE
gimp: dds buffer overflow RCE
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22093.
A parsing vulnerability was found in the GNU Image Manipulation Program (GIMP). This flaw allows an unauthenticated, remote attacker to
Debian
CVE-2023-44441: gimp - GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerabi...
vendor_debian·2023·CVSS 7.8
CVE-2023-44441 [HIGH] CVE-2023-44441: gimp - GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerabi...
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
Scope: local
bookworm: resolved (fixed in 2.10.34-1+deb12u1)
bullseye: resolved (fixed in 2.10.22-4+deb11u1)
forky: resolved (fixed in 2.10.36-1)
sid: resolved (fixed
GHSA
GHSA-mh5h-w46h-67mh: GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ghsa_unreviewed·2024-05-03
CVE-2023-44441 [HIGH] CWE-122 GHSA-mh5h-w46h-67mh: GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22093.
OSV
CVE-2023-44441: GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
osv·2024-05-03·CVSS 7.8
CVE-2023-44441 [HIGH] CVE-2023-44441: GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-03
Published