Critical Security Update for GIMP: Addressing Multiple Remote Code Execution Vulnerabilities
Summary
ALSA-2025:7417: Important: gimp security update. Affects gimp versions < 2:2.99.8-4.el9_6. Fixed in 2:2.99.8-4.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GIMP (GNU Image Manipulation Program) is a powerful open-source image composition and editing tool widely used for tasks such as photo retouching, image editing, and graphic design. It offers a comprehensive toolbox that includes features like layers, effects, and multi-level undo. However, recent vulnerabilities have been identified that could allow attackers to exploit the software, leading to severe security risks.
Vulnerability Detail
The vulnerabilities in GIMP stem from buffer overflow and integer overflow issues in various file formats, including DDS, PSD, and PSP. These vulnerabilities (CVE-2023-44441, CVE-2023-44442, CVE-2023-44443, CVE-2023-44444) can potentially allow remote code execution (RCE), enabling an attacker to execute arbitrary code on the user's system when a maliciously crafted file is opened. This poses a significant risk, especially for users who frequently handle files from untrusted sources.
How To Fix
Minimum fixed version
2:2.99.8-4.el9_6
This is the first release that contains the fix.
sudo dnf update gimpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid opening files from untrusted sources until the software is updated. Additionally, consider using alternative image editing software that does not have these vulnerabilities.
Conclusion
The recent vulnerabilities in GIMP highlight the importance of keeping software up to date to mitigate security risks. By updating to the latest version, users can protect themselves from potential exploits. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for gimp →
FAQ
GIMP is an open-source image manipulation program that allows users to edit and compose images with a variety of tools and features.
The vulnerabilities include buffer overflow and integer overflow issues that can lead to remote code execution when opening malicious files.
You can check your version of GIMP by opening the application and navigating to 'Help' > 'About'. Compare it with the patched version 2:2.99.8-4.el9_6.
If you cannot update immediately, avoid opening files from untrusted sources and consider using alternative software until the update can be applied.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check if your application is affected by visiting the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for gimp.
