Description
Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large (1) red, (2) green, or (3) blue color mask in an XWD file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gimp | 2.8.2-2 | — |
| Debian 13 | gimp | 2.8.2-2 | — |
| Debian 12 | gimp | 2.8.2-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | gimp +4 | 2:2.6.9-6.el6_5 | RHSA-2013:1778 |
| RHEL 5 | gimp +2 | 2:2.2.13-3.el5_10 | RHSA-2013:1778 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gimp | 2.8.18-1.4 | openSUSE-SU-2024:10294-1 |
Advisories 2
- RHSA-2013:1778 Red Hat Security Advisory: gimp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10294-1 gimp-2.8.18-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 51479 third-party-advisory
- 51528 third-party-advisory
- http://git.gnome.org/browse/gimp/commit/?id=2873262fccba12af144ed96ed91be144d92ff2e1
- [oss-security] 20121126 Re: CVE Request: Gimp memory corruption vulnerability mailing-list
- MDVSA-2013:082 vendor-advisory
- USN-1659-1 vendor-advisory
- 56647 vdb-entry
- openSUSE-SU-2013:0123 vendor-advisory
- openSUSE-SU-2012:1623 vendor-advisory
- 50296 third-party-advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=687392