Remote Code Execution

2023-11-2812:57:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

gimp

remote code execution

parsing flaw

dds file

unauthorized code

confidentiality

integrity

availability

7.8 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

15.8%

JSON

GIMP (GNU Image Manipulation Program) is vulnerable to Remote Code Execution (RCE). The vulnerability is caused due to a parsing flaw which allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious DDS file. This can lead to the execution of unauthorized code within the GIMP process compromising confidentiality, Integrity and Availability of the system.

CPENameOperatorVersion
gimp:bookwormeq2.10.28-1
gimp:sideq2.10.28-1
gimp:sideq2.10.22-2
gimp:bullseyeeq2.10.22-2
gimp:edgeeq2.10.32-r5
gimp:edgeeq2.10.32-r0
gimp:edgeeq2.10.30-r1
gimp:edgeeq2.10.24-r0
gimp:edgeeq2.10.12-r5
gimp:edgeeq2.10.22-r0

Name	Operator	Version
gimp:bookworm	eq	2.10.28-1
gimp:sid	eq	2.10.28-1
gimp:sid	eq	2.10.22-2
gimp:bullseye	eq	2.10.22-2
gimp:edge	eq	2.10.32-r5
gimp:edge	eq	2.10.32-r0
gimp:edge	eq	2.10.30-r1
gimp:edge	eq	2.10.24-r0
gimp:edge	eq	2.10.12-r5
gimp:edge	eq	2.10.22-r0