Fluid Attacks Database

Description

Integer overflow in the read_channel_data function in plug-ins/file-psd/psd-load.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a crafted PSD file that triggers a heap-based buffer overflow.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
debian 12	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
debian 13	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
debian 14	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
rpm rhel5	gimp	<2:2.2.13-2.0.7.el5_8.5	2:2.2.13-2.0.7.el5_8.5

Aliases

1. CVE-2009-39092. NVD-2009-39093. OSV-DEBIAN-2009-39094. OSV-2009-39095. SECURITY-TRACKER-CVE-2009-3909

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.