{"result": {"cve": [{"id": "CVE-2013-1978", "type": "cve", "title": "CVE-2013-1978", "description": "Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries.", "published": "2013-12-12T13:55:10", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1978", "cvelist": ["CVE-2013-1978"], "lastseen": "2018-01-09T15:22:51"}, {"id": "CVE-2012-5576", "type": "cve", "title": "CVE-2012-5576", "description": "Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large (1) red, (2) green, or (3) blue color mask in an XWD file.", "published": "2012-12-17T20:55:06", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5576", "cvelist": ["CVE-2012-5576"], "lastseen": "2016-09-03T17:17:01"}, {"id": "CVE-2013-1913", "type": "cve", "title": "CVE-2013-1913", "description": "Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large color entries value in an X Window System (XWD) image dump.", "published": "2013-12-12T13:55:10", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1913", "cvelist": ["CVE-2013-1913"], "lastseen": "2018-01-09T15:22:51"}], "nessus": [{"id": "FEDORA_2013-22701.NASL", "type": "nessus", "title": "Fedora 20 : gimp-2.8.10-4.fc20 (2013-22701)", "description": "This update fixes buffer overflows in the XWD loader.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-12-14T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71419", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-10-29T13:45:38"}, {"id": "UBUNTU_USN-2051-1.NASL", "type": "nessus", "title": "Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : gimp vulnerability (USN-2051-1)", "description": "Murray McAllister discovered that GIMP incorrectly handled malformed XWD files. If a user were tricked into opening a specially crafted XWD file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-12-10T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71309", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-10-29T13:45:54"}, {"id": "FEDORA_2013-22771.NASL", "type": "nessus", "title": "Fedora 18 : gimp-2.8.10-4.fc18 (2013-22771)", "description": "Overview of Changes from GIMP 2.8.8 to GIMP 2.8.10 ==================================================\n\nGUI :\n\n - Indicate if a file was exported in the Quit dialog\n\n - Add shortcuts and hint labels to the close and quit dialogs that make closing and quitting easier and more consistent\n\n - Rename the File->Export menu labels to match Save/Save as\n\n - Fix keyboard shortcuts on OSX Mavericks\n\n - Don't open lots of progress popups when opening many files\n\n - Correctly restore the hidden state of docks in single window mode\n\nLibgimp :\n\n - Fix exporting an image consisting of a single layer group\n\n - Don't attempt to pick transparent colors\n\nPlug-ins :\n\n - Fix crash in LCMS plugin if RGB profile was missing\n\nGeneral :\n\n - Bug fixes\n\n - Translation updates Overview of Changes from GIMP 2.8.8 to GIMP 2.8.10 ==================================================\n\nGUI :\n\n - Indicate if a file was exported in the Quit dialog\n\n - Add shortcuts and hint labels to the close and quit dialogs that make closing and quitting easier and more consistent\n\n - Rename the File->Export menu labels to match Save/Save as\n\n - Fix keyboard shortcuts on OSX Mavericks\n\n - Don't open lots of progress popups when opening many files\n\n - Correctly restore the hidden state of docks in single window mode\n\nLibgimp :\n\n - Fix exporting an image consisting of a single layer group\n\n - Don't attempt to pick transparent colors\n\nPlug-ins :\n\n - Fix crash in LCMS plugin if RGB profile was missing\n\nGeneral :\n\n - Bug fixes\n\n - Translation updates\n\nAdditionally, this update fixes buffer overflows in the XWD loader.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71475", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-10-29T13:41:54"}, {"id": "FEDORA_2013-22776.NASL", "type": "nessus", "title": "Fedora 19 : gimp-2.8.10-4.fc19 (2013-22776)", "description": "This update fixes buffer overflows in the XWD loader.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71476", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-10-29T13:33:22"}, {"id": "DEBIAN_DSA-2813.NASL", "type": "nessus", "title": "Debian DSA-2813-1 : gimp - several vulnerabilities", "description": "Murray McAllister discovered multiple integer and buffer overflows in the XWD plugin in Gimp, which can result in the execution of arbitrary code.", "published": "2013-12-10T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71276", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-10-29T13:41:13"}, {"id": "MANDRIVA_MDVSA-2013-293.NASL", "type": "nessus", "title": "Mandriva Linux Security Advisory : gimp (MDVSA-2013:293)", "description": "Updated gimp package fixes security vulnerabilities :\n\nAn integer overflow flaw and a heap-based buffer overflow were found in the way GIMP loaded certain X Window System (XWD) image dump files.\nA remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP (CVE-2013-1913, CVE-2013-1978).", "published": "2013-12-18T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71512", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-10-29T13:42:39"}, {"id": "ORACLELINUX_ELSA-2013-1778.NASL", "type": "nessus", "title": "Oracle Linux 5 / 6 : gimp (ELSA-2013-1778)", "description": "From Red Hat Security Advisory 2013:1778 :\n\nUpdated gimp packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe GIMP (GNU Image Manipulation Program) is an image composition and editing program.\n\nA stack-based buffer overflow flaw, a heap-based buffer overflow, and an integer overflow flaw were found in the way GIMP loaded certain X Window System (XWD) image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)\n\nThe CVE-2013-1913 and CVE-2013-1978 issues were discovered by Murray McAllister of the Red Hat Security Response Team.\n\nUsers of the GIMP are advised to upgrade to these updated packages, which correct these issues. The GIMP must be restarted for the update to take effect.", "published": "2013-12-04T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71186", "cvelist": ["CVE-2013-1978", "CVE-2012-5576", "CVE-2013-1913"], "lastseen": "2017-10-29T13:38:35"}, {"id": "REDHAT-RHSA-2013-1778.NASL", "type": "nessus", "title": "RHEL 5 / 6 : gimp (RHSA-2013:1778)", "description": "Updated gimp packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.\n\nThe Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe GIMP (GNU Image Manipulation Program) is an image composition and editing program.\n\nA stack-based buffer overflow flaw, a heap-based buffer overflow, and an integer overflow flaw were found in the way GIMP loaded certain X Window System (XWD) image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)\n\nThe CVE-2013-1913 and CVE-2013-1978 issues were discovered by Murray McAllister of the Red Hat Security Response Team.\n\nUsers of the GIMP are advised to upgrade to these updated packages, which correct these issues. The GIMP must be restarted for the update to take effect.", "published": "2013-12-04T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71189", "cvelist": ["CVE-2013-1978", "CVE-2012-5576", "CVE-2013-1913"], "lastseen": "2017-10-29T13:33:39"}, {"id": "SL_20131203_GIMP_ON_SL5_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : gimp on SL5.x, SL6.x i386/x86_64", "description": "A stack-based buffer overflow flaw, a heap-based buffer overflow, and an integer overflow flaw were found in the way GIMP loaded certain X Window System (XWD) image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)\n\nThe GIMP must be restarted for the update to take effect.", "published": "2013-12-10T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=71303", "cvelist": ["CVE-2013-1978", "CVE-2012-5576", "CVE-2013-1913"], "lastseen": "2017-10-29T13:45:43"}, {"id": "GENTOO_GLSA-201603-01.NASL", "type": "nessus", "title": "GLSA-201603-01 : GIMP: Multiple vulnerabilities", "description": "The remote host is affected by the vulnerability described in GLSA-201603-01 (GIMP: Multiple vulnerabilities)\n\n GIMP’s network server, scriptfu, is vulnerable to the remote execution of arbitrary code via the python-fu-eval command due to not requiring authentication. Additionally, the X Window Dump (XWD) plugin is vulnerable to multiple buffer overflows possibly allowing the remote execution of arbitrary code or Denial of Service. The XWD plugin is vulnerable due to not validating large color entries.\n Impact :\n\n A remote attacker could possibly execute arbitrary code with the privileges of the process due or perform a Denial of Service.\n Workaround :\n\n There is no known work around at this time.", "published": "2016-03-07T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=89712", "cvelist": ["CVE-2013-1978", "CVE-2013-1913", "CVE-2012-4245"], "lastseen": "2017-10-29T13:33:00"}], "openvas": [{"id": "OPENVAS:867149", "type": "openvas", "title": "Fedora Update for gimp FEDORA-2013-22776", "description": "Check for the Version of gimp", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=867149", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-01-26T11:10:17"}, {"id": "OPENVAS:841652", "type": "openvas", "title": "Ubuntu Update for gimp USN-2051-1", "description": "Check for the Version of gimp", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=841652", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-01-18T11:08:45"}, {"id": "OPENVAS:1361412562310867355", "type": "openvas", "title": "Fedora Update for gimp FEDORA-2013-22701", "description": "Check for the Version of gimp", "published": "2014-02-03T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867355", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-04-09T11:13:54"}, {"id": "OPENVAS:867355", "type": "openvas", "title": "Fedora Update for gimp FEDORA-2013-22701", "description": "Check for the Version of gimp", "published": "2014-02-03T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=867355", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2017-07-25T10:49:00"}, {"id": "OPENVAS:1361412562310841652", "type": "openvas", "title": "Ubuntu Update for gimp USN-2051-1", "description": "Check for the Version of gimp", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310841652", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-04-06T11:21:21"}, {"id": "OPENVAS:867102", "type": "openvas", "title": "Fedora Update for gimp FEDORA-2013-22771", "description": "Check for the Version of gimp", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=867102", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-01-19T15:09:33"}, {"id": "OPENVAS:1361412562310867102", "type": "openvas", "title": "Fedora Update for gimp FEDORA-2013-22771", "description": "Check for the Version of gimp", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867102", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-04-06T11:23:21"}, {"id": "OPENVAS:1361412562310867149", "type": "openvas", "title": "Fedora Update for gimp FEDORA-2013-22776", "description": "Check for the Version of gimp", "published": "2013-12-17T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867149", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-04-06T11:23:27"}, {"id": "OPENVAS:881826", "type": "openvas", "title": "CentOS Update for gimp CESA-2013:1778 centos6 ", "description": "Check for the Version of gimp", "published": "2013-12-04T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=881826", "cvelist": ["CVE-2013-1978", "CVE-2012-5576", "CVE-2013-1913"], "lastseen": "2017-07-25T10:51:53"}, {"id": "OPENVAS:1361412562310121443", "type": "openvas", "title": "Gentoo Linux Local Check: https://security.gentoo.org/glsa/201603-01", "description": "Gentoo Linux Local Security Checks https://security.gentoo.org/glsa/201603-01", "published": "2016-03-08T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121443", "cvelist": ["CVE-2013-1978", "CVE-2013-1913", "CVE-2012-4245"], "lastseen": "2017-12-08T11:51:34"}], "debian": [{"id": "DSA-2813", "type": "debian", "title": "gimp -- several vulnerabilities", "description": "Murray McAllister discovered multiple integer and buffer overflows in the XWD plugin in Gimp, which can result in the execution of arbitrary code.\n\nFor the oldstable distribution (squeeze), these problems have been fixed in version 2.6.10-1+squeeze4. This update also fixes [CVE-2012-3403](<https://security-tracker.debian.org/tracker/CVE-2012-3403>), [CVE-2012-3481](<https://security-tracker.debian.org/tracker/CVE-2012-3481>) and [CVE-2012-5576](<https://security-tracker.debian.org/tracker/CVE-2012-5576>).\n\nFor the stable distribution (wheezy), these problems have been fixed in version 2.8.2-2+deb7u1.\n\nFor the unstable distribution (sid), these problems will be fixed soon.\n\nWe recommend that you upgrade your gimp packages.", "published": "2013-12-09T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-2813", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2016-09-02T18:20:27"}], "ubuntu": [{"id": "USN-2051-1", "type": "ubuntu", "title": "GIMP vulnerability", "description": "Murray McAllister discovered that GIMP incorrectly handled malformed XWD files. If a user were tricked into opening a specially crafted XWD file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user\u2019s privileges.", "published": "2013-12-09T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/2051-1/", "cvelist": ["CVE-2013-1978", "CVE-2013-1913"], "lastseen": "2018-03-29T18:20:32"}, {"id": "USN-1659-1", "type": "ubuntu", "title": "GIMP vulnerability", "description": "It was discovered that GIMP incorrectly handled malformed XWD files. If a user were tricked into opening a specially crafted XWD file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user\u2019s privileges.", "published": "2012-12-10T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/1659-1/", "cvelist": ["CVE-2012-5576"], "lastseen": "2018-03-29T18:18:59"}], "oraclelinux": [{"id": "ELSA-2013-1778", "type": "oraclelinux", "title": "gimp security update", "description": "[2:2.6.9-6]\n- fix overflow in XWD loader (CVE-2013-1913, CVE-2013-1978)\n[2:2.6.9-5]\n- fix overflow in XWD loader (#879302)\n[2:2.6.9-5]\n- fix overflow in GIF loader (#847303)\n[2:2.6.9-5]\n- fix overflows in GIF, CEL loaders (#727800, #839020)\n[2:2.6.9-4.1]\n- fix various overflows (#666793, #703403, #703405, #703407, #704512)", "published": "2013-12-03T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2013-1778.html", "cvelist": ["CVE-2013-1978", "CVE-2012-5576", "CVE-2013-1913"], "lastseen": "2016-09-04T11:16:57"}, {"id": "ELSA-2016-2589", "type": "oraclelinux", "title": "gimp security, bug fix, and enhancement update", "description": "gimp\n[2:2.8.16-3]\n- fix multiple use-after-free bugs when parsing XCF channel and layer\n properties (#1348617)\n[2:2.8.16-2]\n- add back obsoletes necessary for RHEL\n[2:2.8.16-1]\n- version 2.8.16\n[2:2.8.14-3]\n- export-dialog-destroyed-crash patch: avoid subsequent warnings\n[2:2.8.14-2]\n- fix linking problem\n- use %buildroot macro consistently again\n[2:2.8.14-2]\n- avoid destroying dialog and occasional crashes while exporting (#1215905)\n[2:2.8.14-1.2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild\n[2:2.8.14-1.1]\n- Use better AppData screenshots\n[2:2.8.14-1]\n- version 2.8.14\n[2:2.8.10-6.2]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild\n- update source URL\n[2:2.8.10-6.1]\n- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild\n[2:2.8.10-6]\n- remove ancient obsoletes (#1002109)\n[2:2.8.10-5]\n- cope with freetype >= 2.5.1 include madness\n[2:2.8.10-5]\n- remove BRs contained in the minimal build environment\n- group BRs into libraries and tools\n- remove various old cruft\n- ship RPM macros for packaging plug-ins e.a. (#1063144)\n[2:2.8.10-4]\n- avoid buffer overflows in file-xwd plug-in (CVE-2013-1913, CVE-2013-1978)\ngimp-help\n[2.8.2-1]\n- version 2.8.2\n- use %global instead of %define\n- fix website and source URLs", "published": "2016-11-09T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2016-2589.html", "cvelist": ["CVE-2013-1978", "CVE-2013-1913", "CVE-2016-4994"], "lastseen": "2016-11-09T21:24:05"}], "gentoo": [{"id": "GLSA-201603-01", "type": "gentoo", "title": "GIMP: Multiple vulnerabilities", "description": "### Background\n\nGIMP is a cross-platform image editor available for GNU/Linux, OS X, Windows and more operating systems. \n\n### Description\n\nGIMP\u2019s network server, scriptfu, is vulnerable to the remote execution of arbitrary code via the python-fu-eval command due to not requiring authentication. Additionally, the X Window Dump (XWD) plugin is vulnerable to multiple buffer overflows possibly allowing the remote execution of arbitrary code or Denial of Service. The XWD plugin is vulnerable due to not validating large color entries. \n\n### Impact\n\nA remote attacker could possibly execute arbitrary code with the privileges of the process due or perform a Denial of Service. \n\n### Workaround\n\nThere is no known work around at this time.\n\n### Resolution\n\nAll GIMP users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-gfx/gimp-2.8.0\"", "published": "2016-03-06T00:00:00", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201603-01", "cvelist": ["CVE-2013-1978", "CVE-2013-1913", "CVE-2012-4245"], "lastseen": "2016-09-06T19:46:26"}, {"id": "GLSA-201311-05", "type": "gentoo", "title": "GIMP: Multiple vulnerabilities", "description": "### Background\n\nGIMP is the GNU Image Manipulation Program.\n\n### Description\n\nMultiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted KiSS palette, GIF image or XWD file using GIMP, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll GIMP users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-gfx/gimp-2.8.2-r1\"", "published": "2013-11-10T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201311-05", "cvelist": ["CVE-2012-3403", "CVE-2012-3481", "CVE-2012-5576"], "lastseen": "2016-09-06T19:46:06"}], "redhat": [{"id": "RHSA-2013:1778", "type": "redhat", "title": "(RHSA-2013:1778) Moderate: gimp security update", "description": "The GIMP (GNU Image Manipulation Program) is an image composition and\nediting program.\n\nA stack-based buffer overflow flaw, a heap-based buffer overflow, and an\ninteger overflow flaw were found in the way GIMP loaded certain X Window\nSystem (XWD) image dump files. A remote attacker could provide a specially\ncrafted XWD image file that, when processed, would cause the XWD plug-in to\ncrash or, potentially, execute arbitrary code with the privileges of the\nuser running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)\n\nThe CVE-2013-1913 and CVE-2013-1978 issues were discovered by Murray\nMcAllister of the Red Hat Security Response Team.\n\nUsers of the GIMP are advised to upgrade to these updated packages, which\ncorrect these issues. The GIMP must be restarted for the update to take\neffect.\n", "published": "2013-12-03T05:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2013:1778", "cvelist": ["CVE-2012-5576", "CVE-2013-1913", "CVE-2013-1978"], "lastseen": "2017-09-09T07:19:45"}], "centos": [{"id": "CESA-2013:1778", "type": "centos", "title": "gimp security update", "description": "**CentOS Errata and Security Advisory** CESA-2013:1778\n\n\nThe GIMP (GNU Image Manipulation Program) is an image composition and\nediting program.\n\nA stack-based buffer overflow flaw, a heap-based buffer overflow, and an\ninteger overflow flaw were found in the way GIMP loaded certain X Window\nSystem (XWD) image dump files. A remote attacker could provide a specially\ncrafted XWD image file that, when processed, would cause the XWD plug-in to\ncrash or, potentially, execute arbitrary code with the privileges of the\nuser running the GIMP. (CVE-2012-5576, CVE-2013-1913, CVE-2013-1978)\n\nThe CVE-2013-1913 and CVE-2013-1978 issues were discovered by Murray\nMcAllister of the Red Hat Security Response Team.\n\nUsers of the GIMP are advised to upgrade to these updated packages, which\ncorrect these issues. The GIMP must be restarted for the update to take\neffect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2013-December/020034.html\nhttp://lists.centos.org/pipermail/centos-announce/2013-December/020040.html\n\n**Affected packages:**\ngimp\ngimp-devel\ngimp-devel-tools\ngimp-help-browser\ngimp-libs\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2013-1778.html", "published": "2013-12-03T22:52:31", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2013-December/020034.html", "cvelist": ["CVE-2013-1978", "CVE-2012-5576", "CVE-2013-1913"], "lastseen": "2017-10-03T18:24:38"}], "kaspersky": [{"id": "KLA10168", "type": "kaspersky", "title": "\r KLA10168DoS vulnerability in GIMP\t\t\t ", "description": "### *CVSS*:\n7.5\n\n### *Detect date*:\n12/17/2012\n\n### *Severity*:\nCritical\n\n### *Description*:\nA buffer overflow was found in GIMP. By exploiting this vulnerability malicious users can cause denial of service or possibly execute arbitrary code. This vulnerability can be exploited remotely via a specially designed XWD file.\n\n### *Affected products*:\nGIMP version 2.8.2\n\n### *Solution*:\nUpdate to latest version\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[GIMP](<https://threats.kaspersky.com/en/product/GIMP/>)\n\n### *CVE-IDS*:\n[CVE-2012-5576](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5576>)", "published": "2012-12-17T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://threats.kaspersky.com/en/vulnerability/KLA10168", "cvelist": ["CVE-2012-5576"], "lastseen": "2018-03-30T14:11:21"}]}}