Описание
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
Отчет
This vulnerability in the GIMP file-png plugin can lead to a denial of service. When processing a specially crafted APNG image, the plugin may crash due to a stack buffer overflow. As GIMP executes plugins in separate processes, the main application remains unaffected, limiting the impact to the plugin's functionality.
Меры по смягчению последствий
To mitigate this issue, avoid opening or processing untrusted APNG (Animated Portable Network Graphics) image files with GIMP. Since the vulnerability is triggered by malformed APNG content, restricting interaction with such files will prevent the file-png plugin from crashing. If the plugin crashes, restarting GIMP may be necessary to restore full functionality.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | gimp | Fix deferred | ||
| Red Hat Enterprise Linux 7 | gimp | Fix deferred | ||
| Red Hat Enterprise Linux 8 | gimp:2.8/gimp | Fix deferred | ||
| Red Hat Enterprise Linux 9 | gimp | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
A flaw was found in GIMP's file-png plugin. A remote attacker can expl ...
A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user.
EPSS
5.5 Medium
CVSS3