Critical Security Flaws in GIMP: Addressing Multiple Remote Code Execution Vulnerabilities
Summary
ALSA-2025:3617: Important: gimp security update. Affects gimp versions < 2:2.99.8-4.el9_5. Fixed in 2:2.99.8-4.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GIMP (GNU Image Manipulation Program) is a powerful open-source image composition and editing tool widely used for tasks such as photo retouching, image editing, and graphic design. It offers a comprehensive toolbox that includes features like layers, effects, and multi-level undo capabilities. However, recent vulnerabilities have been identified that could allow attackers to exploit the software, leading to severe security risks.
Vulnerability Detail
The vulnerabilities in GIMP stem from buffer overflow and integer overflow issues in handling specific file formats, including DDS, PSD, and PSP. These flaws can be exploited by attackers to execute arbitrary code remotely, potentially compromising user systems. The identified vulnerabilities are as follows: CVE-2023-44441 (DDS buffer overflow), CVE-2023-44442 (PSD buffer overflow), CVE-2023-44443 (PSP integer overflow), and CVE-2023-44444 (PSP off-by-one error).
How To Fix
Minimum fixed version
2:2.99.8-4.el9_5
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid opening files in the affected formats (DDS, PSD, PSP) until the software is updated. Additionally, running GIMP in a controlled environment or sandbox may help mitigate risks until a patch is applied.
Conclusion
The identified vulnerabilities in GIMP pose significant security risks that can be exploited by attackers. It is crucial for users to update their software to the latest patched version to mitigate these risks. By following the recommended steps and utilizing tools like Vulert, users can enhance their security posture against open-source vulnerabilities.
See every vulnerability recorded for gimp →
FAQ
GIMP is an open-source image manipulation program used for editing and composing images.
The vulnerabilities include buffer overflows and integer overflows that can lead to remote code execution.
You can check your version of GIMP by running 'gimp --version' in the terminal.
If immediate updates are not possible, avoid opening files in the affected formats and consider using a sandbox environment.
Vulert monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, providing real-time alerts without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
