Remote Code Execution

2023-11-2812:57:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gimp

remote code execution

parsing flaw

unauthenticated attacker

psp file

unauthorized code

confidentiality

integrity

availability

system security

7.8 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

15.8%

JSON

GIMP (GNU Image Manipulation Program) is vulnerable to Remote Code Execution (RCE). The vulnerability is caused due to a parsing flaw which allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSP file. This can lead to the execution of unauthorized code within the GIMP process compromising confidentiality, Integrity and Availability of the system.

CPENameOperatorVersion
gimp:bullseyeeq2.10.22-2
gimp:sideq2.10.28-1
gimp:sideq2.10.22-2
gimp:bookwormeq2.10.28-1
gimp:edgeeq2.10.32-r5
gimp:edgeeq2.10.32-r0
gimp:edgeeq2.10.30-r1
gimp:edgeeq2.10.24-r0
gimp:edgeeq2.10.12-r5
gimp:edgeeq2.10.22-r0

Name	Operator	Version
gimp:bullseye	eq	2.10.22-2
gimp:sid	eq	2.10.28-1
gimp:sid	eq	2.10.22-2
gimp:bookworm	eq	2.10.28-1
gimp:edge	eq	2.10.32-r5
gimp:edge	eq	2.10.32-r0
gimp:edge	eq	2.10.30-r1
gimp:edge	eq	2.10.24-r0
gimp:edge	eq	2.10.12-r5
gimp:edge	eq	2.10.22-r0