Hi.
There is a security bug in 'gimp'.

This information is from 'vendor-sec'.

This bug is NOT PUBLIC.

There is no coordinated release date (CRD) set.

More information can be found here:
	http://git.gnome.org/cgit/gimp/commit/?id=e3afc99b2fa7aeddf0dba4778663160a5bc682d3

CVE number: CVE-2009-1570
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1570

Original posting:

@public = no

----- Forwarded message from Secunia Research <vuln@secunia.com> -----

From: Secunia Research <vuln@secunia.com>
To: vendor-sec@lst.de
Cc: vuln@secunia.com
Date: Thu, 12 Nov 2009 14:06:58 +0100
Subject: [vendor-sec] [Secunia] Gimp Integer Overflow Vulnerabilities
Errors-To: vendor-sec-admin@lst.de

Hi,

There are two integer overflows in Gimp (our emails to gimp.org with
more details are attached).

The first one (within the handling of BMP files) was reported to a known
Gimp community member (sven@gimp.org), who handled the report but
politely asked us to contact security@gimp.org next time.

Two days later we reported the second integer overflow (within the
handling of PSD files) to security@gimp.org but received no response so
far.

Unfortunately, the BMP integer overflow is now fixed in the GIT
repository [1] and we are forced to publish our advisory (SA37232). Our
initial plan was to combine both vulnerabilities in SA37232, but the PSD
integer overflow will now be handled in SA37348 (however, it will remain
private for the time being). We assigned CVE-2009-1570 to both
vulnerabilities, but if you prefer to have separate CVE identifiers we
can assign a new one to the PSD vulnerability.

[1]
http://git.gnome.org/cgit/gimp/commit/?id=e3afc99b2fa7aeddf0dba4778663160a5bc682d3

Kind regards,
-- 
Stefan Cornelius
Security Specialist

Secunia 
Weidekampsgade 14 A
DK-2300 Copenhagen S
Denmark

Phone  +45 7020 5144
Fax    +45 7020 5145

Hello,

Secunia Research has discovered a vulnerability in Gimp, which
potentially can be exploited by malicious people to compromise a user's
system.

The vulnerability is caused due to an integer overflow within the
"read_channel_data()" function in plug-ins/file-psd/psd-load.c
(confirmed in line 1764. Note that there are further calculations in
e.g. line 1803, 1808, and 1813). This can be exploited to cause a
heap-based buffer overflow by e.g. tricking a user into opening a
specially crafted PSD file.

Secunia Research has created a PoC, which is available upon request.

The vulnerability is confirmed in version 2.6.7. Other versions may also
be affected.

We have assigned this vulnerability Secunia advisory SA37232 and CVE
identifier CVE-2009-1570, which will be shared with the BMP integer
overflow reported to Sven Neumann on Monday. If you prefer a separate
CVE identifier, we can assign a new one.

A preliminary disclosure date of 25-11-2009 10am CET has been set,
where the details will be publicly disclosed. However, we are naturally
prepared to push the disclosure date if you need more time to address
the vulnerability.

Please acknowledge receiving this e-mail and let us know when you
expect to fix the vulnerability.

Additionally, we would like to be able to follow the bug report
regarding the BMP integer overflow.

Credits should go to:
Stefan Cornelius, Secunia Research

Thanks in advance and kind regards,
-- 
Stefan Cornelius
Security Specialist

Secunia 
Weidekampsgade 14 A
DK-2300 Copenhagen S
Denmark

Phone  +45 7020 5144
Fax    +45 7020 5145

Hello,

Secunia Research has discovered a vulnerability in Gimp, which
potentially can be exploited by malicious people to compromise a user's
system.

The vulnerability is caused due to an integer overflow within the
"ReadImage()" function in plug-ins/file-bmp/bmp-read.c. This can be
exploited to cause a heap-based buffer overflow by e.g. tricking a user
into opening a specially crafted BMP file.

Secunia Research has created a PoC, which is available upon request.

The vulnerability is confirmed in version 2.6.7. Other versions may also
be affected.

We have assigned this vulnerability Secunia advisory SA37232 and CVE
identifier CVE-2009-1570.

A preliminary disclosure date of 25-11-2009 10am CET has been set,
where the details will be publicly disclosed. However, we are naturally
prepared to push the disclosure date if you need more time to address
the vulnerability.

Please acknowledge receiving this e-mail and let us know when you
expect to fix the vulnerability.

Credits should go to:
Stefan Cornelius, Secunia Research

Thanks and kind regards,
-- 
Stefan Cornelius
Security Specialist

Secunia 
Weidekampsgade 14 A
DK-2300 Copenhagen S
Denmark

Phone  +45 7020 5144
Fax    +45 7020 5145


----- End forwarded message -----