Fluid Attacks Database

Description

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	gimp	>=0 <2.8.16-2.2	2.8.16-2.2
debian 11	gimp	>=0 <2.8.16-2.2	2.8.16-2.2
debian 12	gimp	>=0 <2.8.16-2.2	2.8.16-2.2
debian 14	gimp	>=0 <2.8.16-2.2	2.8.16-2.2
rpm rhel5	gimp	-	-
rpm rhel7	gimp	<2:2.8.16-3.el7	2:2.8.16-3.el7
rpm rhel7	gimp-help	<0:2.8.2-1.el7	0:2.8.2-1.el7
rpm rhel6	gimp	-	-

Aliases

1. CVE-2016-49942. NVD-2016-49943. OSV-DEBIAN-2016-49944. OSV-2016-49945. SECURITY-TRACKER-CVE-2016-4994

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.