Description
Stack-based buffer overflow in the loadit function in plug-ins/common/sphere-designer.c in the SPHERE DESIGNER plugin in GIMP 2.6.11 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long "Number of lights" field in a plugin configuration file. NOTE: it may be uncommon to obtain a GIMP plugin configuration file from an untrusted source that is separate from the distribution of the plugin itself.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gimp | 2.6.11-2 | — |
| Debian 13 | gimp | 2.6.11-2 | — |
| Debian 12 | gimp | 2.6.11-2 | — |
| Debian 6.0 | gimp | 2.6.10-1+squeeze3 | DSA-2426-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | gimp +4 | 2:2.6.9-4.el6_1.1 | RHSA-2011:0839 |
| RHEL 5 | gimp +2 | 2:2.2.13-2.0.7.el5_6.2 | RHSA-2011:0838 |
| RHEL 4 | gimp +1 | 1:2.0.5-7.0.7.el4.1 | RHSA-2011:0837 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gimp | 2.8.18-1.4 | openSUSE-SU-2024:10294-1 |
Advisories 5
- RHSA-2011:0839 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0837 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2426-1 gimp - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10294-1 gimp-2.8.18-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2011:0838 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- DSA-2426 vendor-advisory
- GLSA-201209-23 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=666793
- ADV-2011-0016 vdb-entry
- RHSA-2011:0839 vendor-advisory
- RHSA-2011:0837 vendor-advisory
- SUSE-SR:2011:005 vendor-advisory
- RHSA-2011:0838 vendor-advisory
- [oss-security] 20110104 Re: CVE request for buffer overflows in gimp mailing-list
- 44750 third-party-advisory
- 42771 third-party-advisory
- 70281 vdb-entry
- 50737 third-party-advisory
- [oss-security] 20110103 CVE request for buffer overflows in gimp mailing-list
- 48236 third-party-advisory
- gimp-sphere-designer-bo(64581) vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=608497
- MDVSA-2011:103 vendor-advisory