BugTraq
[ MDVSA-2013:293 ] gimp Dec 18 2013 01:29PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:293
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : gimp
Date : December 18, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated gimp package fixes security vulnerabilities:

An integer overflow flaw and a heap-based buffer overflow were found in
the way GIMP loaded certain X Window System (XWD) image dump files. A
remote attacker could provide a specially crafted XWD image file that,
when processed, would cause the XWD plug-in to crash or, potentially,
execute arbitrary code with the privileges of the user running the GIMP
(CVE-2013-1913, CVE-2013-1978).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1913
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1978
http://advisories.mageia.org/MGASA-2013-0365.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
f15f770e4f29aa83895a448a68bb52f9 mbs1/x86_64/gimp-2.8.2-1.1.mbs1.x86_64.rpm
d6e034a095663bdff562dfa31d24cb13 mbs1/x86_64/gimp-python-2.8.2-1.1.mbs1.x86_64.rpm
a7f7cb682deb13ba751abf0fc32ce4c2 mbs1/x86_64/lib64gimp2.0_0-2.8.2-1.1.mbs1.x86_64.rpm
a00244b9c15e58a5dac6f8502189cc32 mbs1/x86_64/lib64gimp2.0-devel-2.8.2-1.1.mbs1.x86_64.rpm
b439aff06112b9c94f3c11aa002bc9de mbs1/SRPMS/gimp-2.8.2-1.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSsXkDmqjQ0CJFipgRAhhFAJ0X6D0fJVgca4P5PNbN5xsU63dxqgCgv63M
A3cXq3aw87YU9Rj8aU4xxPI=
=5Ewm
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus