Synopsis

Moderate: gimp security update

Type/Severity

Security Advisory: Moderate

Topic

Updated gimp packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and
editing program.

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the GIMP's Microsoft Windows Bitmap (BMP) and Personal Computer
eXchange (PCX) image file plug-ins. An attacker could create a
specially-crafted BMP or PCX image file that, when opened, could cause the
relevant plug-in to crash or, potentially, execute arbitrary code with the
privileges of the user running the GIMP. (CVE-2009-1570, CVE-2011-1178)

A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro
(PSP) image file plug-in. An attacker could create a specially-crafted PSP
image file that, when opened, could cause the PSP plug-in to crash or,
potentially, execute arbitrary code with the privileges of the user running
the GIMP. (CVE-2010-4543)

A stack-based buffer overflow flaw was found in the GIMP's Sphere Designer
image filter. An attacker could create a specially-crafted Sphere Designer
filter configuration file that, when opened, could cause the Sphere
Designer plug-in to crash or, potentially, execute arbitrary code with the
privileges of the user running the GIMP. (CVE-2010-4541)

Red Hat would like to thank Stefan Cornelius of Secunia Research for
responsibly reporting the CVE-2009-1570 flaw.

Users of the GIMP are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The GIMP must be
restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc

Fixes

• BZ - 537356 - CVE-2009-1570 Gimp: Integer overflow in the BMP image file plugin
• BZ - 689831 - CVE-2011-1178 Gimp: Integer overflow in the PCX image file plug-in
• BZ - 703403 - CVE-2010-4541 Gimp: Stack-based buffer overflow in SphereDesigner plug-in
• BZ - 703407 - CVE-2010-4543 Gimp: Heap-based buffer overflow in Paint Shop Pro (PSP) plug-in

CVEs

• CVE-2010-4541
• CVE-2010-4543
• CVE-2009-1570
• CVE-2011-1178

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
x86_64
gimp-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 1e3968061341089121ce96070b9340ecf9d466ac4dae73fb53bca21bd170d54c
gimp-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 1e3968061341089121ce96070b9340ecf9d466ac4dae73fb53bca21bd170d54c
gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 2937cbbc4ec73b7beb7e89b4a82b644d77f1221cf3dbef4a129df8a9dd12cc1e
gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 2937cbbc4ec73b7beb7e89b4a82b644d77f1221cf3dbef4a129df8a9dd12cc1e
ia64
gimp-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 851d4ab5e74b5f90aeccfd4da1822bdfadf47d011b53ff40e8d7769147c0028d
gimp-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 851d4ab5e74b5f90aeccfd4da1822bdfadf47d011b53ff40e8d7769147c0028d
gimp-devel-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 5cd7c1644546135d9a01f7750d0a2e0316b574b700317fee9ddd95f2bffd83c9
gimp-devel-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 5cd7c1644546135d9a01f7750d0a2e0316b574b700317fee9ddd95f2bffd83c9
i386
gimp-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 2e91a58d7f1813c918e92d91c80a05dca3d3f798a67992d8bf3dc9c72b72a241
gimp-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 2e91a58d7f1813c918e92d91c80a05dca3d3f798a67992d8bf3dc9c72b72a241
gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 519a217ca645108ed7cfa5b423a321077d93d0aecfcc11e1c508f812a5c8163c
gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 519a217ca645108ed7cfa5b423a321077d93d0aecfcc11e1c508f812a5c8163c

Red Hat Enterprise Linux Server - Extended Update Support 4.8

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
x86_64
gimp-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 1e3968061341089121ce96070b9340ecf9d466ac4dae73fb53bca21bd170d54c
gimp-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 1e3968061341089121ce96070b9340ecf9d466ac4dae73fb53bca21bd170d54c
gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 2937cbbc4ec73b7beb7e89b4a82b644d77f1221cf3dbef4a129df8a9dd12cc1e
gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 2937cbbc4ec73b7beb7e89b4a82b644d77f1221cf3dbef4a129df8a9dd12cc1e
ia64
gimp-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 851d4ab5e74b5f90aeccfd4da1822bdfadf47d011b53ff40e8d7769147c0028d
gimp-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 851d4ab5e74b5f90aeccfd4da1822bdfadf47d011b53ff40e8d7769147c0028d
gimp-devel-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 5cd7c1644546135d9a01f7750d0a2e0316b574b700317fee9ddd95f2bffd83c9
gimp-devel-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 5cd7c1644546135d9a01f7750d0a2e0316b574b700317fee9ddd95f2bffd83c9
i386
gimp-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 2e91a58d7f1813c918e92d91c80a05dca3d3f798a67992d8bf3dc9c72b72a241
gimp-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 2e91a58d7f1813c918e92d91c80a05dca3d3f798a67992d8bf3dc9c72b72a241
gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 519a217ca645108ed7cfa5b423a321077d93d0aecfcc11e1c508f812a5c8163c
gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 519a217ca645108ed7cfa5b423a321077d93d0aecfcc11e1c508f812a5c8163c

Red Hat Enterprise Linux Workstation 4

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
x86_64
gimp-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 1e3968061341089121ce96070b9340ecf9d466ac4dae73fb53bca21bd170d54c
gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 2937cbbc4ec73b7beb7e89b4a82b644d77f1221cf3dbef4a129df8a9dd12cc1e
ia64
gimp-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 851d4ab5e74b5f90aeccfd4da1822bdfadf47d011b53ff40e8d7769147c0028d
gimp-devel-2.0.5-7.0.7.el4.1.ia64.rpm	SHA-256: 5cd7c1644546135d9a01f7750d0a2e0316b574b700317fee9ddd95f2bffd83c9
i386
gimp-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 2e91a58d7f1813c918e92d91c80a05dca3d3f798a67992d8bf3dc9c72b72a241
gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 519a217ca645108ed7cfa5b423a321077d93d0aecfcc11e1c508f812a5c8163c

Red Hat Enterprise Linux Desktop 4

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
x86_64
gimp-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 1e3968061341089121ce96070b9340ecf9d466ac4dae73fb53bca21bd170d54c
gimp-devel-2.0.5-7.0.7.el4.1.x86_64.rpm	SHA-256: 2937cbbc4ec73b7beb7e89b4a82b644d77f1221cf3dbef4a129df8a9dd12cc1e
i386
gimp-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 2e91a58d7f1813c918e92d91c80a05dca3d3f798a67992d8bf3dc9c72b72a241
gimp-devel-2.0.5-7.0.7.el4.1.i386.rpm	SHA-256: 519a217ca645108ed7cfa5b423a321077d93d0aecfcc11e1c508f812a5c8163c

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
s390x
gimp-2.0.5-7.0.7.el4.1.s390x.rpm	SHA-256: b4754c80e23775501323882ce9595215ab9e2446c6b58fc475ee1fa2f834131e
gimp-devel-2.0.5-7.0.7.el4.1.s390x.rpm	SHA-256: e92b7d43cad66bc18d7e4986e259d784bf675889f55ae70f607775d43d558fcc
s390
gimp-2.0.5-7.0.7.el4.1.s390.rpm	SHA-256: 694c126c7c2721df49c27d75d7e485207d7ae6007c77b9b0486b804e04bb693e
gimp-devel-2.0.5-7.0.7.el4.1.s390.rpm	SHA-256: 3b72662265920ccd79c4a58be985d5d382968a894029c22820dd9d7c14fa8fdb

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
s390x
gimp-2.0.5-7.0.7.el4.1.s390x.rpm	SHA-256: b4754c80e23775501323882ce9595215ab9e2446c6b58fc475ee1fa2f834131e
gimp-devel-2.0.5-7.0.7.el4.1.s390x.rpm	SHA-256: e92b7d43cad66bc18d7e4986e259d784bf675889f55ae70f607775d43d558fcc
s390
gimp-2.0.5-7.0.7.el4.1.s390.rpm	SHA-256: 694c126c7c2721df49c27d75d7e485207d7ae6007c77b9b0486b804e04bb693e
gimp-devel-2.0.5-7.0.7.el4.1.s390.rpm	SHA-256: 3b72662265920ccd79c4a58be985d5d382968a894029c22820dd9d7c14fa8fdb

Red Hat Enterprise Linux for Power, big endian 4

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
ppc
gimp-2.0.5-7.0.7.el4.1.ppc.rpm	SHA-256: df23801cf6db5add606c7b3f27a4670fd8bf30633d988c4c1a374d0a9046fdf5
gimp-devel-2.0.5-7.0.7.el4.1.ppc.rpm	SHA-256: 7173cc2cce526205ddf8da61330f3eb3922bc1d2b98e35fb31ed6050565b4192

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8

SRPM
gimp-2.0.5-7.0.7.el4.1.src.rpm	SHA-256: 823620157f9f9d3b90bbb484bf2bae973b72d2a87407793d2a33b6b0e4a0799e
ppc
gimp-2.0.5-7.0.7.el4.1.ppc.rpm	SHA-256: df23801cf6db5add606c7b3f27a4670fd8bf30633d988c4c1a374d0a9046fdf5
gimp-devel-2.0.5-7.0.7.el4.1.ppc.rpm	SHA-256: 7173cc2cce526205ddf8da61330f3eb3922bc1d2b98e35fb31ed6050565b4192