Synopsis: Moderate: gimp security update Issue Date: 2011-05-31 CVE Numbers: CVE-2009-1570 CVE-2011-1178 CVE-2010-4541 CVE-2010-4543 The GIMP (GNU Image Manipulation Program) is an image composition and editing program. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the GIMP's Microsoft Windows Bitmap (BMP) and Personal Computer eXchange (PCX) image file plug-ins. An attacker could create a specially-crafted BMP or PCX image file that, when opened, could cause the relevant plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2009-1570, CVE-2011-1178) A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro (PSP) image file plug-in. An attacker could create a specially-crafted PSP image file that, when opened, could cause the PSP plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4543) A stack-based buffer overflow flaw was found in the GIMP's Sphere Designer image filter. An attacker could create a specially-crafted Sphere Designer filter configuration file that, when opened, could cause the Sphere Designer plug-in to crash or, potentially, execute arbitrary code with the privileges of the user running the GIMP. (CVE-2010-4541) Users of the GIMP are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The GIMP must be restarted for the update to take effect. SL4: x86_64 gimp-2.0.5-7.0.7.el4.1.x86_64.rpm gimp-debuginfo-2.0.5-7.0.7.el4.1.x86_64.rpm gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm i386 gimp-2.0.5-7.0.7.el4.1.i386.rpm gimp-debuginfo-2.0.5-7.0.7.el4.1.i386.rpm gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm - Scientific Linux Development Team