Fluid Attacks Database

Description

Integer overflow in the ReadImage function in plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers to execute arbitrary code via a BMP file with crafted width and height values that trigger a heap-based buffer overflow.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
debian 13	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
debian 11	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
debian 14	gimp	>=0 <2.6.7-1.1	2.6.7-1.1
rpm rhel5	gimp	<2:2.2.13-2.0.7.el5_6.2	2:2.2.13-2.0.7.el5_6.2

Aliases

1. CVE-2009-15702. NVD-2009-15703. OSV-DEBIAN-2009-15704. OSV-2009-15705. SECURITY-TRACKER-CVE-2009-1570

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.