Message-ID: <20060710143142.GF5030@piware.de>
Date: Mon, 10 Jul 2006 16:31:42 +0200
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-312-1] gimp vulnerability

=========================================================== 
Ubuntu Security Notice USN-312-1              July 10, 2006
gimp vulnerability
CVE-2006-3404
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.04
Ubuntu 5.10
Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.04:
  gimp                           2.2.2-1ubuntu5.1
  libgimp2.0                     2.2.2-1ubuntu5.1

Ubuntu 5.10:
  gimp                           2.2.8-2ubuntu6.1
  libgimp2.0                     2.2.8-2ubuntu6.1

Ubuntu 6.06 LTS:
  gimp                           2.2.11-1ubuntu3.1
  libgimp2.0                     2.2.11-1ubuntu3.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Henning Makholm discovered that gimp did not sufficiently validate the
'num_axes' parameter in XCF files. By tricking a user into opening a
specially crafted XCF file with Gimp, an attacker could exploit this
to execute arbitrary code with the user's privileges.


Updated packages for Ubuntu 5.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.2-1ubuntu5.1.diff.gz
      Size/MD5:    25366 1c89e7a4876c8922baf9c3be9cce72b9
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.2-1ubuntu5.1.dsc
      Size/MD5:     1053 41cbd27c48207a245d8486d37c3bea44
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.2.orig.tar.gz
      Size/MD5: 20151209 eccbe0b2438be095222a6723e57c51a3

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-data_2.2.2-1ubuntu5.1_all.deb
      Size/MD5:  2057404 4d2655688e65317c1cce1f7938c415b3
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp1.2_2.2.2-1ubuntu5.1_all.deb
      Size/MD5:    23028 c55d030036cc817eba07f15a31cd2ab9
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-doc_2.2.2-1ubuntu5.1_all.deb
      Size/MD5:   516766 2bddbe64aae9009428e16f40ff0ac92c

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.2-1ubuntu5.1_amd64.deb
      Size/MD5:    34686 1491899331d67c323414df5625b378ad
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.2-1ubuntu5.1_amd64.deb
      Size/MD5:   114452 c0d1e1ea2cb6ec1ed06b6327a91e5da6
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.2-1ubuntu5.1_amd64.deb
      Size/MD5:    34686 c3726bb2cf00dc202439253ab8e5f47f
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.2-1ubuntu5.1_amd64.deb
      Size/MD5:  3138104 4cbd06980a263a956eaf2ed8a61fae14
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.2-1ubuntu5.1_amd64.deb
      Size/MD5:    90072 e876c374828beb7951d8d1bb6323ef00
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.2-1ubuntu5.1_amd64.deb
      Size/MD5:   434012 4ef7e7e58e45d192a8877747c432efdf

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.2-1ubuntu5.1_i386.deb
      Size/MD5:    33386 e3249682facaedc43430c2a02f55be4f
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.2-1ubuntu5.1_i386.deb
      Size/MD5:   108648 883b24c54ef4fec71777d601eca58b64
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.2-1ubuntu5.1_i386.deb
      Size/MD5:    33806 ff701d78ebb13b876ea4651a00e06dce
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.2-1ubuntu5.1_i386.deb
      Size/MD5:  2822064 333aba3cca28c59606ef01e688a98fdc
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.2-1ubuntu5.1_i386.deb
      Size/MD5:    90074 13fa37935cb5334bd13406119f326bee
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.2-1ubuntu5.1_i386.deb
      Size/MD5:   404102 a9812964cf7257f5ae9609a95efb6a0f

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.2-1ubuntu5.1_powerpc.deb
      Size/MD5:    34918 d46155c0c3ec7e265972c27156255595
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.2-1ubuntu5.1_powerpc.deb
      Size/MD5:   110434 d0c4290c8a30db183db627df47b901ce
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.2-1ubuntu5.1_powerpc.deb
      Size/MD5:    35606 c8f11092c804ba676de10fb0ee0206e5
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.2-1ubuntu5.1_powerpc.deb
      Size/MD5:  3208564 ee4badf2b0ccaebd84dabeb123f5e98a
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.2-1ubuntu5.1_powerpc.deb
      Size/MD5:    90100 073cc2a24d7be2923c1a1750661bbc9e
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.2-1ubuntu5.1_powerpc.deb
      Size/MD5:   428626 65b3e8b890dbcf005442c935a061169d

Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8-2ubuntu6.1.diff.gz
      Size/MD5:    30972 004d46b2721db233a1037378a76ad219
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8-2ubuntu6.1.dsc
      Size/MD5:     1084 e1f078639ad1201614e0c830fad88f61
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8.orig.tar.gz
      Size/MD5: 20529098 4d543228967a8d33a8276339c40ffe64

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-data_2.2.8-2ubuntu6.1_all.deb
      Size/MD5:  2079192 d100e3e9b066e18a9fc1358237eecc90
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp1.2_2.2.8-2ubuntu6.1_all.deb
      Size/MD5:    34806 ffd1badac2770f6f7fd2af0382a8d4f0
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-doc_2.2.8-2ubuntu6.1_all.deb
      Size/MD5:   519014 5557d213c447c8719475b63b4f275570

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.8-2ubuntu6.1_amd64.deb
      Size/MD5:    46334 cf5aa30f0a710e0a2a5d3b5d1f31de82
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.8-2ubuntu6.1_amd64.deb
      Size/MD5:   126774 57b5c7fb31d5fd4c7a893a46aa9f59c8
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.8-2ubuntu6.1_amd64.deb
      Size/MD5:    46420 f8540a7d00dc18d5d014c9c5d571a280
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8-2ubuntu6.1_amd64.deb
      Size/MD5:  3178830 1d4a121e227396c6c67558dd62c3e66e
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.8-2ubuntu6.1_amd64.deb
      Size/MD5:   101984 04238d839cba2fb1f62e12178f27f06f
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.8-2ubuntu6.1_amd64.deb
      Size/MD5:   446672 49cc4af975ae1820ac27431f0dfc382b

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.8-2ubuntu6.1_i386.deb
      Size/MD5:    45178 32211947773168a74e8a32a96f1d7977
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.8-2ubuntu6.1_i386.deb
      Size/MD5:   119216 9c8ea7d961f3008894ae311c88c51a4a
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.8-2ubuntu6.1_i386.deb
      Size/MD5:    45512 181b1d11a870434b6143a05f817abba3
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8-2ubuntu6.1_i386.deb
      Size/MD5:  2805454 3751247190e54a478dd3e4bd09ec1d01
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.8-2ubuntu6.1_i386.deb
      Size/MD5:   101976 01cf59d7bd98979b7f4731a156454c8d
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.8-2ubuntu6.1_i386.deb
      Size/MD5:   403820 e1d8643a2f489f570ec4cbff690de43e

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.8-2ubuntu6.1_powerpc.deb
      Size/MD5:    46774 283d55a3942da3e25f91222292256260
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.8-2ubuntu6.1_powerpc.deb
      Size/MD5:   122710 d73fc3e1820c125e18af9bc5f546c489
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.8-2ubuntu6.1_powerpc.deb
      Size/MD5:    47426 9640175231edeb56cefbcd1b2b64942c
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8-2ubuntu6.1_powerpc.deb
      Size/MD5:  3263286 21ee97ed61ca4cf5814c4c16bfa25390
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.8-2ubuntu6.1_powerpc.deb
      Size/MD5:   102008 6155784e2c64ec20a2e2dedb207b835b
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.8-2ubuntu6.1_powerpc.deb
      Size/MD5:   438484 9ecff496283a2ce8eb1c80ecfe462e39

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.8-2ubuntu6.1_sparc.deb
      Size/MD5:    45234 69d43426f6ad3b9df471a8f6cf17ce7a
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.8-2ubuntu6.1_sparc.deb
      Size/MD5:   120352 1ef0f1997cd115e06c0e70afdc7ae3ec
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.8-2ubuntu6.1_sparc.deb
      Size/MD5:    45708 c8b2309d4456cec39618f02e203ff701
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.8-2ubuntu6.1_sparc.deb
      Size/MD5:  2876458 7bc16fd12c4388293176983a874785f4
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.8-2ubuntu6.1_sparc.deb
      Size/MD5:   101994 a0875688cfcdc478b88a8bd0488435f8
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.8-2ubuntu6.1_sparc.deb
      Size/MD5:   422928 e0ba6fd3923075ee5856dd7bbcb47b01

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11-1ubuntu3.1.diff.gz
      Size/MD5:    33861 004dcc1835345fc1d474f6fa2dbf15ab
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11-1ubuntu3.1.dsc
      Size/MD5:     1266 d353df1f507926d72eedaba11c564932
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11.orig.tar.gz
      Size/MD5: 18549092 c4312189e3a7f869a26874854dc6a1d7

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-data_2.2.11-1ubuntu3.1_all.deb
      Size/MD5:  2093412 4cdda893bedc7e4e8cecdfd68b73cc04
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-doc_2.2.11-1ubuntu3.1_all.deb
      Size/MD5:   527466 8edee6915a0ad1a6d45a14ab8ecc847a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-dbg_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:  8473344 1a6612ca5386e16e44adc93554c2567e
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:    53096 665807789fecc435294fdda90d58fe35
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:   133490 2cb5b3d370051bad846a5963fbccaf24
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:    53156 148b06d4fc0661241adbf234c4f814fa
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:  3147966 763f65666e85c50004284d518ccfc4f5
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:   108734 16ad76637519d42d8afdc780978db281
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.11-1ubuntu3.1_amd64.deb
      Size/MD5:   453440 620657d5342af6e5fb9736b56c49e322

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-dbg_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:  7197248 997dcf3438d2df3f97515b57069b0a6d
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:    51792 37ea6be3a30463338060e70a4de58ec0
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:   125872 ce230923c066949ec6314b50a666484c
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:    52220 0a094c0178ed7034404a87e391f66f73
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:  2777714 4faf75153a46135a8d8c7b9d6b10c986
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:   108758 b4ed9b42f95fc07aa809fc49e2538ba8
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.11-1ubuntu3.1_i386.deb
      Size/MD5:   410296 0725cc03751a2bbcee0707a0975bc2ed

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-dbg_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:  8506604 46a43967bff3eb77bf8a2018208fc847
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:    53564 b44a95cf20502d19c8e331c8577c07d8
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:   129400 986c1e4c82efc7c81a7aa7b72e44d90a
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:    54222 2efc43f1a03e224bd342514b0d01a799
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:  3229098 e500ce8a902d0837ec4d19f7b511c3ba
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:   108760 153b87573a51321a5d1ecd5cfc0f0698
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.11-1ubuntu3.1_powerpc.deb
      Size/MD5:   444870 b5bb55e95bb99d6b091a52a06997ddcd

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-dbg_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:  7493990 d1a7b839cf5ede21cdb9017d031fd404
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-helpbrowser_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:    51956 209e08ed952a02a16acbe32de2cdc760
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp-python_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:   127186 36c4e2ec85bce5a19d8dac0573bf0436
    http://security.ubuntu.com/ubuntu/pool/universe/g/gimp/gimp-svg_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:    52422 908d3b06661d753ccbc7f445080aeb14
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/gimp_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:  2821484 2a90f76cb39506c026577a1ecdad031d
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0-dev_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:   108758 07790df1c789e274534c5506e463288f
    http://security.ubuntu.com/ubuntu/pool/main/g/gimp/libgimp2.0_2.2.11-1ubuntu3.1_sparc.deb
      Size/MD5:   428780 86eaed52e36beb83a3eef41f21f810a9


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists