Synopsis

Moderate: gimp security update

Type/Severity

Security Advisory: Moderate

Topic

Updated gimp packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

The GIMP (GNU Image Manipulation Program) is an image composition and
editing program.

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the GIMP's Microsoft Windows Bitmap (BMP) and Personal Computer
eXchange (PCX) image file plug-ins. An attacker could create a
specially-crafted BMP or PCX image file that, when opened, could cause the
relevant plug-in to crash or, potentially, execute arbitrary code with the
privileges of the user running the GIMP. (CVE-2009-1570, CVE-2011-1178)

A heap-based buffer overflow flaw was found in the GIMP's Paint Shop Pro
(PSP) image file plug-in. An attacker could create a specially-crafted PSP
image file that, when opened, could cause the PSP plug-in to crash or,
potentially, execute arbitrary code with the privileges of the user running
the GIMP. (CVE-2010-4543)

A stack-based buffer overflow flaw was found in the GIMP's Lightning,
Sphere Designer, and Gfig image filters. An attacker could create a
specially-crafted Lightning, Sphere Designer, or Gfig filter configuration
file that, when opened, could cause the relevant plug-in to crash or,
potentially, execute arbitrary code with the privileges of the user running
the GIMP. (CVE-2010-4540, CVE-2010-4541, CVE-2010-4542)

Red Hat would like to thank Stefan Cornelius of Secunia Research for
responsibly reporting the CVE-2009-1570 flaw.

Users of the GIMP are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The GIMP must be
restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.6 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x

Fixes

• BZ - 537356 - CVE-2009-1570 Gimp: Integer overflow in the BMP image file plugin
• BZ - 666793 - CVE-2010-4540 Gimp: Stack-based buffer overflow in Lighting plug-in
• BZ - 689831 - CVE-2011-1178 Gimp: Integer overflow in the PCX image file plug-in
• BZ - 703403 - CVE-2010-4541 Gimp: Stack-based buffer overflow in SphereDesigner plug-in
• BZ - 703405 - CVE-2010-4542 Gimp: Stack-based buffer overflow in Gfig plug-in
• BZ - 703407 - CVE-2010-4543 Gimp: Heap-based buffer overflow in Paint Shop Pro (PSP) plug-in

CVEs

• CVE-2010-4541
• CVE-2010-4540
• CVE-2010-4543
• CVE-2010-4542
• CVE-2009-1570
• CVE-2011-1178

References

• https://access.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-devel-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 47f385ec5f5c2261ce94529e15ab73d252c60e4a3188b1c6820bb135230926b3
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
ia64
gimp-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 7ea391e9bc84567bc06f06aeb84530ab0f79e66094c38dd5c945459dcb1d1253
gimp-devel-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 6bd16adf610dc21d5691ff2845bdb8f6ed15ef0d3d11b9a27c171d7e4aa0472b
gimp-libs-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 51284d701b095ed3984f960c4e719016a0cdb64290224d7056fe174d0c917c0d
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-devel-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 47f385ec5f5c2261ce94529e15ab73d252c60e4a3188b1c6820bb135230926b3
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
ia64
gimp-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 7ea391e9bc84567bc06f06aeb84530ab0f79e66094c38dd5c945459dcb1d1253
gimp-devel-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 6bd16adf610dc21d5691ff2845bdb8f6ed15ef0d3d11b9a27c171d7e4aa0472b
gimp-libs-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 51284d701b095ed3984f960c4e719016a0cdb64290224d7056fe174d0c917c0d
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-devel-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 47f385ec5f5c2261ce94529e15ab73d252c60e4a3188b1c6820bb135230926b3
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
ia64
gimp-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 7ea391e9bc84567bc06f06aeb84530ab0f79e66094c38dd5c945459dcb1d1253
gimp-devel-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 6bd16adf610dc21d5691ff2845bdb8f6ed15ef0d3d11b9a27c171d7e4aa0472b
gimp-libs-2.2.13-2.0.7.el5_6.2.ia64.rpm	SHA-256: 51284d701b095ed3984f960c4e719016a0cdb64290224d7056fe174d0c917c0d
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5

Red Hat Enterprise Linux Workstation 5

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-devel-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 47f385ec5f5c2261ce94529e15ab73d252c60e4a3188b1c6820bb135230926b3
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5

Red Hat Enterprise Linux Desktop 5

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
s390x
gimp-2.2.13-2.0.7.el5_6.2.s390x.rpm	SHA-256: 78d175ea4869287268032636074fc2363ea8dd81b2310511adea717c70bbd79b
gimp-devel-2.2.13-2.0.7.el5_6.2.s390.rpm	SHA-256: ce52e5b26ae836759c1f348a8f2d1a768ffb6450dcb7d07c5f80610300282f32
gimp-devel-2.2.13-2.0.7.el5_6.2.s390x.rpm	SHA-256: 7bd526eeae0ad7fac94e36d4721a02f3daaa4c224cb3a6a660c4f496e491172c
gimp-libs-2.2.13-2.0.7.el5_6.2.s390.rpm	SHA-256: f5ffa6f8c753ab9a308bbeb740ba7f4d880863e2ecfee31291a932f8e89d6ad3
gimp-libs-2.2.13-2.0.7.el5_6.2.s390x.rpm	SHA-256: e8a02412bd0d8cd5963b2960e44c23a5dca47e6d2e53f8dde98029651ac055e2

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
s390x
gimp-2.2.13-2.0.7.el5_6.2.s390x.rpm	SHA-256: 78d175ea4869287268032636074fc2363ea8dd81b2310511adea717c70bbd79b
gimp-devel-2.2.13-2.0.7.el5_6.2.s390.rpm	SHA-256: ce52e5b26ae836759c1f348a8f2d1a768ffb6450dcb7d07c5f80610300282f32
gimp-devel-2.2.13-2.0.7.el5_6.2.s390x.rpm	SHA-256: 7bd526eeae0ad7fac94e36d4721a02f3daaa4c224cb3a6a660c4f496e491172c
gimp-libs-2.2.13-2.0.7.el5_6.2.s390.rpm	SHA-256: f5ffa6f8c753ab9a308bbeb740ba7f4d880863e2ecfee31291a932f8e89d6ad3
gimp-libs-2.2.13-2.0.7.el5_6.2.s390x.rpm	SHA-256: e8a02412bd0d8cd5963b2960e44c23a5dca47e6d2e53f8dde98029651ac055e2

Red Hat Enterprise Linux for Power, big endian 5

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
ppc
gimp-2.2.13-2.0.7.el5_6.2.ppc.rpm	SHA-256: c9c4e1f2b2204eea7eb49bc06b52209c11ed9cd9da92e0b8eaa4d7b45aef7fa6
gimp-devel-2.2.13-2.0.7.el5_6.2.ppc.rpm	SHA-256: f98ec1659740a1773aec4ee2db7c06ba9286c7008e876aac7b27eb351e6efbdf
gimp-devel-2.2.13-2.0.7.el5_6.2.ppc64.rpm	SHA-256: a319e63fa74a380bb4e847cdfe4d320c77f41c693505e2a3c5d4eec70a84077c
gimp-libs-2.2.13-2.0.7.el5_6.2.ppc.rpm	SHA-256: c45ce521fbb33b2ff853c62d89dd2c04e0de2d6ac41fbe00d46e9c6d92d422bb
gimp-libs-2.2.13-2.0.7.el5_6.2.ppc64.rpm	SHA-256: 94f8123c7d7b00e55ca52d437e27205cf8ecfb292d32223a868868b90d875ec8

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
ppc
gimp-2.2.13-2.0.7.el5_6.2.ppc.rpm	SHA-256: c9c4e1f2b2204eea7eb49bc06b52209c11ed9cd9da92e0b8eaa4d7b45aef7fa6
gimp-devel-2.2.13-2.0.7.el5_6.2.ppc.rpm	SHA-256: f98ec1659740a1773aec4ee2db7c06ba9286c7008e876aac7b27eb351e6efbdf
gimp-devel-2.2.13-2.0.7.el5_6.2.ppc64.rpm	SHA-256: a319e63fa74a380bb4e847cdfe4d320c77f41c693505e2a3c5d4eec70a84077c
gimp-libs-2.2.13-2.0.7.el5_6.2.ppc.rpm	SHA-256: c45ce521fbb33b2ff853c62d89dd2c04e0de2d6ac41fbe00d46e9c6d92d422bb
gimp-libs-2.2.13-2.0.7.el5_6.2.ppc64.rpm	SHA-256: 94f8123c7d7b00e55ca52d437e27205cf8ecfb292d32223a868868b90d875ec8

Red Hat Enterprise Linux Server from RHUI 5

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-devel-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 47f385ec5f5c2261ce94529e15ab73d252c60e4a3188b1c6820bb135230926b3
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
gimp-2.2.13-2.0.7.el5_6.2.src.rpm	SHA-256: 1e204b4d747de72f8c56a70e33f7512bb079e8931eb15e64af50e6a1815b50a0
x86_64
gimp-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 321eee92a6ed52553f2b190137fcc2de459c9c652f7cef8686438800344f6b3e
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-devel-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: 47f385ec5f5c2261ce94529e15ab73d252c60e4a3188b1c6820bb135230926b3
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5
gimp-libs-2.2.13-2.0.7.el5_6.2.x86_64.rpm	SHA-256: f78369db188237c5dfc1f56628e39e7b41fb420461511c817a7978c8364b58f2
i386
gimp-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: a574d6c779324d32a0325ea87f4155d65c2fe11a9c2dfaa3ea2e9852cd035ad0
gimp-devel-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 6c1d26861d86f3b0e59833eac7d0710d8c2c50f5421eca86d2371be648f6d9ed
gimp-libs-2.2.13-2.0.7.el5_6.2.i386.rpm	SHA-256: 1524e7cfb12ef236af6f6456ce98c82e2b2fb30a1fc671764c930782c3238dc5