cbcvebase.
CVE-2023-44442
published 2024-05-03

CVE-2023-44442: GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…

PriorityP261high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
61.43%
99.1th percentile
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.

Affected

7 ranges
VendorProductVersion rangeFixed in
debiangimp< gimp 2.10.34-1+deb12u1 (bookworm)gimp 2.10.34-1+deb12u1 (bookworm)
gimpgimp< 2.10.362.10.36
gimpgimp
gimpgimp>= 0 < 2.10.22-4+deb11u12.10.22-4+deb11u1
gimpgimp>= 0 < 2.10.34-1+deb12u12.10.34-1+deb12u1
gimpgimp>= 0 < 2.10.36-12.10.36-1
gimpgimp>= 0 < 2.10.36-12.10.36-1

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered by opening a malicious PSD file in GIMP; monitor for GIMP processes opening PSD files from untrusted/web-sourced locations.
  • The flaw is specifically in GIMP's PSD file parsing code path; detection should focus on heap-based buffer overflow indicators triggered during PSD parsing within the GIMP process.
  • Arbitrary code executes within the GIMP process context; monitor for anomalous child processes or network activity spawned from the GIMP process after opening a PSD file.
  • ·Fixed versions are available; systems running GIMP versions prior to the patched releases remain vulnerable. Debian bookworm fixed in 2.10.34-1+deb12u1, bullseye in 2.10.22-4+deb11u1, and sid/trixie/forky in 2.10.36-1.
  • ·Red Hat Enterprise Linux 6 is out of support scope; no mitigation is available from Red Hat for affected GIMP packages on that platform.

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.