CVE-2023-44444
published 2024-05-03CVE-2023-44444: GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected…
PriorityP359high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
56.40%
98.9th percentile
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22097.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gimp | < gimp 2.10.34-1+deb12u1 (bookworm) | gimp 2.10.34-1+deb12u1 (bookworm) |
| gimp | gimp | < 2.10.36 | 2.10.36 |
| gimp | gimp | — | — |
| gimp | gimp | >= 0 < 2.10.22-4+deb11u1 | 2.10.22-4+deb11u1 |
| gimp | gimp | >= 0 < 2.10.34-1+deb12u1 | 2.10.34-1+deb12u1 |
| gimp | gimp | >= 0 < 2.10.36-1 | 2.10.36-1 |
| gimp | gimp | >= 0 < 2.10.36-1 | 2.10.36-1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: crafted PSP file causes an off-by-one error when calculating a heap-buffer write location during PSP file parsing in GIMP ↗
- →Attack vector requires user to open a malicious PSP file or visit a malicious page that delivers one — monitor for unexpected .psp file opens in GIMP ↗
- →Code execution occurs within the GIMP process context — look for anomalous child processes or network activity spawned from the gimp process after opening a PSP file ↗
- ·Debian fixed versions: bookworm fixed in 2.10.34-1+deb12u1, bullseye fixed in 2.10.22-4+deb11u1, forky/sid/trixie fixed in 2.10.36-1 — installations below these versions remain vulnerable ↗
- ·Red Hat Enterprise Linux 6 (gimp package) is out of support scope and no mitigation meeting Red Hat Product Security criteria is available ↗
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-44444: GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
osv·2024-05-03·CVSS 7.8
CVE-2023-44444 [HIGH] CVE-2023-44444: GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
GHSA
GHSA-w7g8-vmhg-qvwm: GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
ghsa_unreviewed·2024-05-03
CVE-2023-44444 [HIGH] CWE-193 GHSA-w7g8-vmhg-qvwm: GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22097.
Ubuntu
GIMP vulnerabilities
vendor_ubuntu·2023-11-29
CVE-2022-30067 GIMP vulnerabilities
Title: GIMP vulnerabilities
Summary: GIMP could be made to crash or run programs as your login if it
opened a specially crafted file.
It was discovered that GIMP incorrectly handled certain image files. If a
user were tricked into opening a specially crafted image, an attacker could
use this issue to cause GIMP to crash, resulting in a denial of service, or
possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
gimp: psp off-by-one RCE
vendor_redhat·2023-11-14·CVSS 7.8
CVE-2023-44444 [HIGH] CWE-193 gimp: psp off-by-one RCE
gimp: psp off-by-one RCE
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-22097.
A parsing vulnerability was found in the GNU Image Manipulation Program (GIMP). This flaw allows an unauthenticated, remote attacker to trick a GIMP user into openin
Debian
CVE-2023-44444: gimp - GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulne...
vendor_debian·2023·CVSS 7.8
CVE-2023-44444 [HIGH] CVE-2023-44444: gimp - GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulne...
GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097.
Scope: local
bookworm: resolved (fixed in 2.10.34-1+deb12u1)
bullseye: resolved (fixed in 2.10.22-4+deb11u1)
forky: resolved (fixed in 2.10.36-1)
sid: resolved (fixed in 2.10.36-1)
trixie: res
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-05-03
Published