Fluid Attacks Database

Description

Heap-based buffer overflow in the KiSS CEL file format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted KiSS palette file, which triggers an "invalid free."

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	gimp	>=0 <2.8.2-1	2.8.2-1
debian 11	gimp	>=0 <2.8.2-1	2.8.2-1
debian 14	gimp	>=0 <2.8.2-1	2.8.2-1
debian 13	gimp	>=0 <2.8.2-1	2.8.2-1
rpm rhel6	gimp	<2:2.6.9-4.el6_3.3	2:2.6.9-4.el6_3.3
rpm rhel5	gimp	<2:2.2.13-2.0.7.el5_8.5	2:2.2.13-2.0.7.el5_8.5

Aliases

1. CVE-2012-34032. NVD-2012-34033. OSV-DEBIAN-2012-34034. OSV-2012-34035. SECURITY-TRACKER-CVE-2012-3403

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.