CVE-2010-4541 Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service....
HighCVSS 9.3
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long "Number of lights" field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gimp | = 2.6.11 | No fix listed |
| debian/gimp(Debian:12) | < 2.6.11-2 | 2.6.11-2 |
| debian/gimp(Debian:13) | < 2.6.11-2 | 2.6.11-2 |
| debian/gimp(Debian:14) | < 2.6.11-2 | 2.6.11-2 |
References
- bugs.debian.org third-party-advisory
- SUSE-SR:2011:005 third-party-advisory vendor-advisory
- [oss-security] 20110103 CVE request for buffer overflows in gimp mailing-list third-party-advisory
- [oss-security] 20110104 Re: CVE request for buffer overflows in gimp mailing-list third-party-advisory
- 70281 broken-link vdb-entry
- 42771 broken-link third-party-advisory
- 44750 broken-link third-party-advisory
- 48236 broken-link third-party-advisory
- 50737 broken-link third-party-advisory
- GLSA-201209-23 third-party-advisory vendor-advisory
- DSA-2426 third-party-advisory vendor-advisory
- MDVSA-2011:103 broken-link vendor-advisory
- RHSA-2011:0837 broken-link vendor-advisory
- RHSA-2011:0838 broken-link vendor-advisory
- RHSA-2011:0839 broken-link vendor-advisory
- ADV-2011-0016 broken-link vdb-entry vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- gimp-sphere-designer-bo(64581) third-party-advisory vdb-entry
- Debian Security Tracker CVE-2010-4541 vendor-advisory
- bugs.debian.org issue-tracking