Issued:
2007-05-21
Updated:
2007-05-21

RHSA-2007:0343 - Security Advisory

Synopsis

Moderate: gimp security update

Type/Severity

Security Advisory: Moderate

Topic

Updated gimp packages that fix a security issue are now available for Red
Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and
editing program.

Marsu discovered a stack overflow bug in The GIMP RAS file loader. An
attacker could create a carefully crafted file that could cause The GIMP to
crash or possibly execute arbitrary code if the file was opened by a
victim. (CVE-2007-2356)

For users of Red Hat Enterprise Linux 5, the previous GIMP packages had a
bug that concerned the execution order in which the symbolic links to
externally packaged GIMP plugins are installed and removed, causing the
symbolic links to vanish when the package is updated.

Users of The GIMP should update to these erratum packages which contain a
backported fix to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Although the execution order problem in GIMP packages for Red Hat
Enterprise Linux 5 is fixed in these erratum packages, due to the
nature of the problem it will show up once more when updating from an
affected version to a fixed version. To add these symbolic links back in,
run the following command after installation of the new packages:

/usr/sbin/gimp-plugin-mgr --install \*

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 ia64
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 ia64
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 238420 - CVE-2007-2356 Stack overflow in gimp's sunras plugin
  • BZ - 238993 - gimp removes symlinks to plugins of other packages when updated

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
x86_64
gimp-2.2.13-2.el5.x86_64.rpm SHA-256: f4a03234221c285f55fc2c913729ec8f118a1e5885c8f005c630a54c64275697
gimp-devel-2.2.13-2.el5.i386.rpm SHA-256: 7cfd683b3a130b68aded7cb2255f262bab48cab64ce2535b6a6fdd3283eda6e0
gimp-devel-2.2.13-2.el5.x86_64.rpm SHA-256: 54a80338f3c66fd93de00a834b691233d7a562f04c747829d98a351d6f67dd6d
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c
gimp-libs-2.2.13-2.el5.x86_64.rpm SHA-256: 746917c699ceeb73d4e408ebd6b4a5da6dce1a137f45fc9429509b0864710f28
ia64
gimp-2.2.13-2.el5.ia64.rpm SHA-256: 6e9c8a60ee14e2ba9b5cdf132b9de44674c9d6a0b3b0bf9f3d0c8963ae0b0b56
gimp-devel-2.2.13-2.el5.ia64.rpm SHA-256: 1766866654c84c32e79f5326828ed5bcea09776aa111ae84f4af6e583531dd7b
gimp-libs-2.2.13-2.el5.ia64.rpm SHA-256: 695ee1166f3067a892248ed6a4c2dab776d1545ee1d844f0eb0900f2e3a50af3
i386
gimp-2.2.13-2.el5.i386.rpm SHA-256: f9784f21ddc9fb620819ee185666f81622af0f0c4c0f710bc000daece0ca9df9
gimp-devel-2.2.13-2.el5.i386.rpm SHA-256: 7cfd683b3a130b68aded7cb2255f262bab48cab64ce2535b6a6fdd3283eda6e0
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c

Red Hat Enterprise Linux Server 4

SRPM
x86_64
gimp-2.0.5-6.2.el4.x86_64.rpm SHA-256: 2664653854789a4e477d7b60dd0bc4a897399a0c5807a0df96061be7d867a36d
gimp-2.0.5-6.2.el4.x86_64.rpm SHA-256: 2664653854789a4e477d7b60dd0bc4a897399a0c5807a0df96061be7d867a36d
gimp-devel-2.0.5-6.2.el4.x86_64.rpm SHA-256: 433306d54161346b1e9c697f4404b78e8f4a0f789d0c988515d9e444fa6adf29
gimp-devel-2.0.5-6.2.el4.x86_64.rpm SHA-256: 433306d54161346b1e9c697f4404b78e8f4a0f789d0c988515d9e444fa6adf29
ia64
gimp-2.0.5-6.2.el4.ia64.rpm SHA-256: 9a72f050d4b4ea94f9d2c43d51ee10b10ad33e55be2b95e671f67c3f261e39e9
gimp-2.0.5-6.2.el4.ia64.rpm SHA-256: 9a72f050d4b4ea94f9d2c43d51ee10b10ad33e55be2b95e671f67c3f261e39e9
gimp-devel-2.0.5-6.2.el4.ia64.rpm SHA-256: d87145c6a411cdbec9685d85d0baa62158d714eee3466f75c986bdd46f2f969e
gimp-devel-2.0.5-6.2.el4.ia64.rpm SHA-256: d87145c6a411cdbec9685d85d0baa62158d714eee3466f75c986bdd46f2f969e
i386
gimp-2.0.5-6.2.el4.i386.rpm SHA-256: 1777eecca9ee3efee12928c40c98efab06b69767e8a19a16da0e688520fd14ae
gimp-2.0.5-6.2.el4.i386.rpm SHA-256: 1777eecca9ee3efee12928c40c98efab06b69767e8a19a16da0e688520fd14ae
gimp-devel-2.0.5-6.2.el4.i386.rpm SHA-256: d6118b4c391ce9486773284935ec3e1d420b72b8a3ec787fdbf2f7dc1fecd678
gimp-devel-2.0.5-6.2.el4.i386.rpm SHA-256: d6118b4c391ce9486773284935ec3e1d420b72b8a3ec787fdbf2f7dc1fecd678

Red Hat Enterprise Linux Server - Extended Update Support 4.5

SRPM
x86_64
gimp-2.0.5-6.2.el4.x86_64.rpm SHA-256: 2664653854789a4e477d7b60dd0bc4a897399a0c5807a0df96061be7d867a36d
gimp-2.0.5-6.2.el4.x86_64.rpm SHA-256: 2664653854789a4e477d7b60dd0bc4a897399a0c5807a0df96061be7d867a36d
gimp-devel-2.0.5-6.2.el4.x86_64.rpm SHA-256: 433306d54161346b1e9c697f4404b78e8f4a0f789d0c988515d9e444fa6adf29
gimp-devel-2.0.5-6.2.el4.x86_64.rpm SHA-256: 433306d54161346b1e9c697f4404b78e8f4a0f789d0c988515d9e444fa6adf29
ia64
gimp-2.0.5-6.2.el4.ia64.rpm SHA-256: 9a72f050d4b4ea94f9d2c43d51ee10b10ad33e55be2b95e671f67c3f261e39e9
gimp-2.0.5-6.2.el4.ia64.rpm SHA-256: 9a72f050d4b4ea94f9d2c43d51ee10b10ad33e55be2b95e671f67c3f261e39e9
gimp-devel-2.0.5-6.2.el4.ia64.rpm SHA-256: d87145c6a411cdbec9685d85d0baa62158d714eee3466f75c986bdd46f2f969e
gimp-devel-2.0.5-6.2.el4.ia64.rpm SHA-256: d87145c6a411cdbec9685d85d0baa62158d714eee3466f75c986bdd46f2f969e
i386
gimp-2.0.5-6.2.el4.i386.rpm SHA-256: 1777eecca9ee3efee12928c40c98efab06b69767e8a19a16da0e688520fd14ae
gimp-2.0.5-6.2.el4.i386.rpm SHA-256: 1777eecca9ee3efee12928c40c98efab06b69767e8a19a16da0e688520fd14ae
gimp-devel-2.0.5-6.2.el4.i386.rpm SHA-256: d6118b4c391ce9486773284935ec3e1d420b72b8a3ec787fdbf2f7dc1fecd678
gimp-devel-2.0.5-6.2.el4.i386.rpm SHA-256: d6118b4c391ce9486773284935ec3e1d420b72b8a3ec787fdbf2f7dc1fecd678

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
gimp-2.2.13-2.el5.x86_64.rpm SHA-256: f4a03234221c285f55fc2c913729ec8f118a1e5885c8f005c630a54c64275697
gimp-devel-2.2.13-2.el5.i386.rpm SHA-256: 7cfd683b3a130b68aded7cb2255f262bab48cab64ce2535b6a6fdd3283eda6e0
gimp-devel-2.2.13-2.el5.x86_64.rpm SHA-256: 54a80338f3c66fd93de00a834b691233d7a562f04c747829d98a351d6f67dd6d
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c
gimp-libs-2.2.13-2.el5.x86_64.rpm SHA-256: 746917c699ceeb73d4e408ebd6b4a5da6dce1a137f45fc9429509b0864710f28
i386
gimp-2.2.13-2.el5.i386.rpm SHA-256: f9784f21ddc9fb620819ee185666f81622af0f0c4c0f710bc000daece0ca9df9
gimp-devel-2.2.13-2.el5.i386.rpm SHA-256: 7cfd683b3a130b68aded7cb2255f262bab48cab64ce2535b6a6fdd3283eda6e0
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
gimp-2.0.5-6.2.el4.x86_64.rpm SHA-256: 2664653854789a4e477d7b60dd0bc4a897399a0c5807a0df96061be7d867a36d
gimp-devel-2.0.5-6.2.el4.x86_64.rpm SHA-256: 433306d54161346b1e9c697f4404b78e8f4a0f789d0c988515d9e444fa6adf29
ia64
gimp-2.0.5-6.2.el4.ia64.rpm SHA-256: 9a72f050d4b4ea94f9d2c43d51ee10b10ad33e55be2b95e671f67c3f261e39e9
gimp-devel-2.0.5-6.2.el4.ia64.rpm SHA-256: d87145c6a411cdbec9685d85d0baa62158d714eee3466f75c986bdd46f2f969e
i386
gimp-2.0.5-6.2.el4.i386.rpm SHA-256: 1777eecca9ee3efee12928c40c98efab06b69767e8a19a16da0e688520fd14ae
gimp-devel-2.0.5-6.2.el4.i386.rpm SHA-256: d6118b4c391ce9486773284935ec3e1d420b72b8a3ec787fdbf2f7dc1fecd678

Red Hat Enterprise Linux Desktop 5

SRPM
x86_64
gimp-2.2.13-2.el5.x86_64.rpm SHA-256: f4a03234221c285f55fc2c913729ec8f118a1e5885c8f005c630a54c64275697
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c
gimp-libs-2.2.13-2.el5.x86_64.rpm SHA-256: 746917c699ceeb73d4e408ebd6b4a5da6dce1a137f45fc9429509b0864710f28
i386
gimp-2.2.13-2.el5.i386.rpm SHA-256: f9784f21ddc9fb620819ee185666f81622af0f0c4c0f710bc000daece0ca9df9
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
gimp-2.0.5-6.2.el4.x86_64.rpm SHA-256: 2664653854789a4e477d7b60dd0bc4a897399a0c5807a0df96061be7d867a36d
gimp-devel-2.0.5-6.2.el4.x86_64.rpm SHA-256: 433306d54161346b1e9c697f4404b78e8f4a0f789d0c988515d9e444fa6adf29
i386
gimp-2.0.5-6.2.el4.i386.rpm SHA-256: 1777eecca9ee3efee12928c40c98efab06b69767e8a19a16da0e688520fd14ae
gimp-devel-2.0.5-6.2.el4.i386.rpm SHA-256: d6118b4c391ce9486773284935ec3e1d420b72b8a3ec787fdbf2f7dc1fecd678

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
s390x
gimp-2.2.13-2.el5.s390x.rpm SHA-256: 5e247f985ba95a6a5e2b3f8f1478d1163e08400a625eb104ab7363f70851bcf3
gimp-devel-2.2.13-2.el5.s390.rpm SHA-256: acd516d2853430eff92c9e85b8faea2a397c3638285feb9fb025ba75290f7a3d
gimp-devel-2.2.13-2.el5.s390x.rpm SHA-256: affe52a58874c66cbb61a4a3e0ee7ca19de96e596a2f68ba583d9f70ef1e6ac9
gimp-libs-2.2.13-2.el5.s390.rpm SHA-256: e9b9fc840a5799dfd114699f03bfdb65b2ad9b8be36a4c1e8a8e5e6cb695697c
gimp-libs-2.2.13-2.el5.s390x.rpm SHA-256: 55ce7b6c8a061e4a1b055821fbf5383a59c1039b548437713bf13d2078a2008d

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
gimp-2.0.5-6.2.el4.s390x.rpm SHA-256: 4c8f969d4e19fcd62d0a068de3966992e98cbae8d556459b415734fdc6b2a4da
gimp-devel-2.0.5-6.2.el4.s390x.rpm SHA-256: d26e3ec9aa8431ad6ba2e564ef76f9800c7a0eb024162382c9a48742f8249ee3
s390
gimp-2.0.5-6.2.el4.s390.rpm SHA-256: 736e0c3315eea9b9445a8f4880184822a85320b576194f8bac3c4aed163e1268
gimp-devel-2.0.5-6.2.el4.s390.rpm SHA-256: bf27b6c996bbd7bb15ca5c978c1ffa978d738a1b1a16241630cba4d0b4837bb2

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5

SRPM
s390x
gimp-2.0.5-6.2.el4.s390x.rpm SHA-256: 4c8f969d4e19fcd62d0a068de3966992e98cbae8d556459b415734fdc6b2a4da
gimp-devel-2.0.5-6.2.el4.s390x.rpm SHA-256: d26e3ec9aa8431ad6ba2e564ef76f9800c7a0eb024162382c9a48742f8249ee3
s390
gimp-2.0.5-6.2.el4.s390.rpm SHA-256: 736e0c3315eea9b9445a8f4880184822a85320b576194f8bac3c4aed163e1268
gimp-devel-2.0.5-6.2.el4.s390.rpm SHA-256: bf27b6c996bbd7bb15ca5c978c1ffa978d738a1b1a16241630cba4d0b4837bb2

Red Hat Enterprise Linux for Power, big endian 5

SRPM
ppc
gimp-2.2.13-2.el5.ppc.rpm SHA-256: 060fdda2f1da5db3e3b8f9799b7b09c84258f195e3c3137ae7ee80bf76ed56dd
gimp-devel-2.2.13-2.el5.ppc.rpm SHA-256: ae3e979174ea39366224fad671238a1163130a55c369ff9f9983f01c49291742
gimp-devel-2.2.13-2.el5.ppc64.rpm SHA-256: 3b91e540be88603a42c7a32f33e1a4dbb3a9229cd21959b60d9fc5b599170b10
gimp-libs-2.2.13-2.el5.ppc.rpm SHA-256: cf6b5b5bf3e1104ee98b353b46144d5b20112326365c8edc792184807d28c715
gimp-libs-2.2.13-2.el5.ppc64.rpm SHA-256: a8d723313d6d405287527030de6ba2e7036477d22d8845d6a62a406e196a473f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
gimp-2.0.5-6.2.el4.ppc.rpm SHA-256: 41b1e2b6a2ef3f6adb3379456841ca683517881ce190e2c9456b6e9d638d3590
gimp-devel-2.0.5-6.2.el4.ppc.rpm SHA-256: d59ae1a5fe713618da958a73c516fe011a81edae1a97f7d9f1b3bb45bcaaa55b

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5

SRPM
ppc
gimp-2.0.5-6.2.el4.ppc.rpm SHA-256: 41b1e2b6a2ef3f6adb3379456841ca683517881ce190e2c9456b6e9d638d3590
gimp-devel-2.0.5-6.2.el4.ppc.rpm SHA-256: d59ae1a5fe713618da958a73c516fe011a81edae1a97f7d9f1b3bb45bcaaa55b

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
gimp-2.2.13-2.el5.x86_64.rpm SHA-256: f4a03234221c285f55fc2c913729ec8f118a1e5885c8f005c630a54c64275697
gimp-devel-2.2.13-2.el5.i386.rpm SHA-256: 7cfd683b3a130b68aded7cb2255f262bab48cab64ce2535b6a6fdd3283eda6e0
gimp-devel-2.2.13-2.el5.x86_64.rpm SHA-256: 54a80338f3c66fd93de00a834b691233d7a562f04c747829d98a351d6f67dd6d
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c
gimp-libs-2.2.13-2.el5.x86_64.rpm SHA-256: 746917c699ceeb73d4e408ebd6b4a5da6dce1a137f45fc9429509b0864710f28
i386
gimp-2.2.13-2.el5.i386.rpm SHA-256: f9784f21ddc9fb620819ee185666f81622af0f0c4c0f710bc000daece0ca9df9
gimp-devel-2.2.13-2.el5.i386.rpm SHA-256: 7cfd683b3a130b68aded7cb2255f262bab48cab64ce2535b6a6fdd3283eda6e0
gimp-libs-2.2.13-2.el5.i386.rpm SHA-256: 0d76c56db036554d36602f2c194311d207f32153ba2693011524f3cd4796b74c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.