Integer overflow in Gimp

CVE-2007-2949

Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.

Vulnerability class: Integer Overflow

EPSS: 0.072 (93.6th percentile) — read the EPSS interpretation.

Affected products

Gimp
Canonical Ubuntu_linux — versions 6.06, 6.10, 7.04
N/a — versions n/a

Weakness classification (CWE)

CWE-190 — Integer Overflow or Wraparound

References

PSIRT-CNA@flexerasoftware.com (Patch, x_refsource_MISC, Broken Link, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM, Broken Link)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
PSIRT-CNA@flexerasoftware.com (vendor-advisory, Third Party Advisory, x_refsource_SLACKWARE)
PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_OSVDB, vdb-entry, Broken Link)