cbcvebase.
CVE-2023-44443
published 2024-05-03

CVE-2023-44443: GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected…

PriorityP264high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
93.64%
99.8th percentile
GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096.

Affected

7 ranges
VendorProductVersion rangeFixed in
debiangimp< gimp 2.10.34-1+deb12u1 (bookworm)gimp 2.10.34-1+deb12u1 (bookworm)
gimpgimp< 2.10.362.10.36
gimpgimp
gimpgimp>= 0 < 2.10.22-4+deb11u12.10.22-4+deb11u1
gimpgimp>= 0 < 2.10.34-1+deb12u12.10.34-1+deb12u1
gimpgimp>= 0 < 2.10.36-12.10.36-1
gimpgimp>= 0 < 2.10.36-12.10.36-1

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered by opening a malicious PSP (Paint Shop Pro) file in GIMP. Detection should focus on GIMP processes opening .psp files from untrusted/external sources.
  • User interaction is required — attack vector involves social engineering a user to open a malicious file or visit a malicious page delivering a .psp file.
  • Code execution occurs within the GIMP process context. Monitor for anomalous child processes or network activity spawned from the GIMP process after opening a PSP file.
  • ·Fixed versions are available; vulnerable GIMP versions are those prior to the patched releases listed per distribution. Red Hat Enterprise Linux 7 and 8 ship unaffected versions.
  • ·Debian fixed versions: bookworm fixed in 2.10.34-1+deb12u1, bullseye fixed in 2.10.22-4+deb11u1, forky/sid/trixie fixed in 2.10.36-1.

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.