Nixpkgs security tracker
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICNS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28530.
References
-
ZDI-26-120 x_research-advisory
-
vendor-provided URL vendor-advisory
Affected products
- ==3.0.6
Matching in nixpkgs
pkgs.gimp
GNU Image Manipulation Program
pkgs.gimp2
GNU Image Manipulation Program
pkgs.gimp3
GNU Image Manipulation Program
pkgs.zigimports
Automatically remove unused imports and globals from Zig files
pkgs.gimpPlugins.bimp
Batch Image Manipulation Plugin for GIMP
pkgs.gimpPlugins.gimp
GNU Image Manipulation Program
pkgs.gimpPlugins.gmic
GIMP plugin for the G'MIC image processing framework
pkgs.gimp-with-plugins
GNU Image Manipulation Program
pkgs.gimp2Plugins.bimp
Batch Image Manipulation Plugin for GIMP
pkgs.gimp2Plugins.gimp
GNU Image Manipulation Program
pkgs.gimp2Plugins.gmic
GIMP plugin for the G'MIC image processing framework
pkgs.gimp3Plugins.gimp
GNU Image Manipulation Program
pkgs.gimp3Plugins.gmic
GIMP plugin for the G'MIC image processing framework
pkgs.gimp2-with-plugins
GNU Image Manipulation Program
pkgs.gimp3-with-plugins
GNU Image Manipulation Program
pkgs.gimpPlugins.fourier
GIMP plug-in to do the fourier transform
pkgs.gimp2Plugins.fourier
GIMP plug-in to do the fourier transform
pkgs.gimpPlugins.farbfeld
Gimp plug-in for the farbfeld image format
pkgs.gimp2Plugins.farbfeld
Gimp plug-in for the farbfeld image format
-
nixos-unstable 2019-08-12
- nixpkgs-unstable 2019-08-12
- nixos-unstable-small 2019-08-12
-
nixos-25.11 2019-08-12
- nixos-25.11-small 2019-08-12
- nixpkgs-25.11-darwin 2019-08-12
pkgs.gimpPlugins.lightning
None
pkgs.gimpPlugins.lqrPlugin
None
pkgs.gimpPlugins.texturize
None
pkgs.gimp2Plugins.lightning
None
pkgs.gimp2Plugins.lqrPlugin
None
pkgs.gimp2Plugins.texturize
None
-
nixos-unstable 2.2+unstable=2021-12-03
- nixpkgs-unstable 2.2+unstable=2021-12-03
- nixos-unstable-small 2.2+unstable=2021-12-03
-
nixos-25.11 2.2+unstable=2021-12-03
- nixos-25.11-small 2.2+unstable=2021-12-03
- nixpkgs-25.11-darwin 2.2+unstable=2021-12-03
pkgs.gimp3Plugins.lightning
None
pkgs.gimpPlugins.gimplensfun
GIMP plugin to correct lens distortion using the lensfun library and database
pkgs.gimp2Plugins.gimplensfun
GIMP plugin to correct lens distortion using the lensfun library and database
-
nixos-unstable 2018-10-21
- nixpkgs-unstable 2018-10-21
- nixos-unstable-small 2018-10-21
-
nixos-25.11 2018-10-21
- nixos-25.11-small 2018-10-21
- nixpkgs-25.11-darwin 2018-10-21
pkgs.gimpPlugins.resynthesizer
None
pkgs.gimpPlugins.waveletSharpen
None
Package maintainers
-
@jtojnar Jan Tojnar <jtojnar@gmail.com>
-
@sikmir Nikolay Korotkiy <sikmir@disroot.org>
-
@jmbaur Jared Baur <jaredbaur@fastmail.com>