Gimp SUNRAS Plugin "set_color_table()" Buffer Overflow - Advisories

Gimp SUNRAS Plugin "set_color_table()" Buffer Overflow

Secunia Advisory:	SA25012
Release Date:	2007-04-27
Last Update:	2007-05-28

Critical:	Moderately critical
Impact:	System access
Where:	From remote
Solution Status:	Vendor Patch

Software:	GIMP 2.x

CVE reference:	CVE-2007-2356 (Secunia mirror)

	Want to know the next time vulnerabilities are fixed in this product? - Companies can be alerted via email and SMS!

Description: Marsu has discovered a vulnerability in Gimp, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an error within the "set_color_table()" function in plug-ins/common/sunras.c. This can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted .RAS file. Successful exploitation may allow the execution of arbitrary code. The vulnerability is confirmed in version 2.2.14. Other versions may also be affected. Solution: Update to version 2.2.15. Provided and/or discovered by: Marsu Changelog: 2007-05-02: Added CVE reference. 2007-05-28: Updated "Solution" section. Original Advisory: http://milw0rm.com/exploits/3801



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

2 Related Secunia Security Advisories

1. Gimp Loader Plugins Integer Overflow Vulnerabilities

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Mozilla Firefox Multiple Vulnerabilities

2.	Opera for Windows Unspecified Code Execution

3.	Opera Canvas Functions Information Disclosure

4.	PCRE pcre_compile.c Buffer Overflow Vulnerability

5.	VLC Media Player WAV Processing Integer Overflow

6.	GNOME Glib PCRE pcre_compile.c Buffer Overflow Vulnerability

7.	Mozilla Thunderbird Multiple Vulnerabilities

8.	UnixWare ReliantHA Privilege Escalation Vulnerabilities

9.	Novell eDirectory ds.dlm Module Buffer Overflow

10.	Internet Explorer 7 Frame Location Handling Vulnerability