bugtraq - [SECURITY] [DSA 3612-1] gimp security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1bJ3t7-0003Zo-Qw@master.debian.org>
Date: Fri, 01 Jul 2016 19:14:05 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3612-1] gimp security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3612-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
July 01, 2016                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : gimp
CVE ID         : CVE-2016-4994
Debian Bug     : 828179

Shmuel H discovered that GIMP, the GNU Image Manipulation Program, is
prone to a use-after-free vulnerability in the channel and layer
properties parsing process when loading a XCF file. An attacker can take
advantage of this flaw to potentially execute arbitrary code with the
privileges of the user running GIMP if a specially crafted XCF file is
processed.

For the stable distribution (jessie), this problem has been fixed in
version 2.8.14-1+deb8u1.

We recommend that you upgrade your gimp packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJXdsBPAAoJEAVMuPMTQ89Ea+EP/1mtrvA85JjJ2qEeOZv2BXdv
LejgxNS/AYcCyR727amTW+yX5EVfR/9hqyCpBEwhHvNkGEm75bXpg0/5ghfAOl6t
P18EEI+tdS9udjs4Q8vdGw4f3uIyVftslr5NwZGQMhwfn1ReTAaxTIkm6V/WHbNd
BYeztngS9TecQr73nCOSCm8gu1cnRW1GPVq7IveSwq/graMTMoIlYVQsLYmjGUbm
V5TIcpiwGNITt+Y+kIFlU9gpMqSyOK3GM7tUW8twsOwq5M6D+GalzUT6XOt98tJy
TKvEVDlZZ13+VIT8IoU+asHkGnvo/UQ8NnK36Qbb51ryRk3blJ+BrmCoQRxEFukh
N40+Robzg7a8RAkf/SpANNN5Y20Rh6ppsuPjCzcHadV1HPG1U0n2xfgToSVs8ugp
/EG+YMlLxjWlkWqfGKLmKNep1pfPg0lfDy7BKmTQs59DZDezBcW4jLxOIerXGTcf
DVE5kCqI9llENpE/OzGrcYNbjp0zaKj54e6zmjOsuutboPtaCx+F7Fmk8qSsgHek
VoefcX+jeH3RUNzULWkzfWCfLXjSkBpcZTWKqSbZnWIXw8kedMsgF7dfvMT82Xd+
9k2CJwUQU8ooJSWUnk7ltHAq9z47KObQYPm7HCD/9iSsksRgDbIrc2YyYYnddHd2
lj05eED6pwhvA7/UqYHD
=1m4Q
-----END PGP SIGNATURE-----