NVD Vulnerability Detail

CVE-2012-5576

Summary	Multiple stack-based buffer overflows in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.8.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large (1) red, (2) green, or (3) blue color mask in an XWD file.
Publication Date	Dec. 18, 2012, 10:55 a.m.
Registration Date	Jan. 28, 2021, 3:06 p.m.
Last Update	Nov. 21, 2024, 10:44 a.m.

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:gimp:gimp::::::::					2.8.4

Related information, measures and tools

No	URL	タグ
1	http://git.gnome.org/browse/gimp/commit/?id=2873262fccba12af144ed96ed91be144d92ff2e1	Patch Vendor Advisory
2	http://git.gnome.org/browse/gimp/commit/?id=2873262fccba12af144ed96ed91be144d92ff2e1	Patch Vendor Advisory
3	http://lists.opensuse.org/opensuse-updates/2012-12/msg00017.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2012-12/msg00017.html	Third Party Advisory
5	http://lists.opensuse.org/opensuse-updates/2013-01/msg00014.html	Third Party Advisory
6	http://lists.opensuse.org/opensuse-updates/2013-01/msg00014.html	Third Party Advisory
7	http://secunia.com/advisories/50296	Broken Link
8	http://secunia.com/advisories/50296	Broken Link
9	http://secunia.com/advisories/51479	Broken Link
10	http://secunia.com/advisories/51479	Broken Link
11	http://secunia.com/advisories/51528	Broken Link
12	http://secunia.com/advisories/51528	Broken Link
13	http://www.mandriva.com/security/advisories?name=MDVSA-2013:082	Broken Link
14	http://www.mandriva.com/security/advisories?name=MDVSA-2013:082	Broken Link
15	http://www.openwall.com/lists/oss-security/2012/11/27/1	Mailing List Third Party Advisory
16	http://www.openwall.com/lists/oss-security/2012/11/27/1	Mailing List Third Party Advisory
17	http://www.securityfocus.com/bid/56647	Third Party Advisory VDB Entry
18	http://www.securityfocus.com/bid/56647	Third Party Advisory VDB Entry
19	http://www.ubuntu.com/usn/USN-1659-1	Patch Third Party Advisory
20	http://www.ubuntu.com/usn/USN-1659-1	Patch Third Party Advisory
21	https://bugzilla.gnome.org/show_bug.cgi?id=687392	Exploit Issue Tracking Patch Third Party Advisory
22	https://bugzilla.gnome.org/show_bug.cgi?id=687392	Exploit Issue Tracking Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

GIMP の X Window Dump プラグインにおけるサービス運用妨害 (クラッシュ) の脆弱性

Title	GIMP の X Window Dump プラグインにおけるサービス運用妨害 (クラッシュ) の脆弱性
Summary	GIMP の X Window Dump (XWD) プラグインの file-xwd.c には、サービス運用妨害 (クラッシュ) 状態になる、および任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、XWD ファイル内の過度に大きな (1) 赤、(2) 緑、または (3) 青のカラーマスクを介して、サービス運用妨害 (クラッシュ) 状態にされる、および任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 7, 2012, midnight
Registration Date	Dec. 19, 2012, 3:45 p.m.
Last Update	Dec. 19, 2012, 3:45 p.m.

Affected System

The GIMP Team

GIMP 2.8.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5576	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5576
National Vulnerability Database (NVD)
2	CVE-2012-5576	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5576

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
GIMP
1	Top Page	http://www.gimp.org/
GNOME
2	gimp	http://git.gnome.org/browse/gimp/commit/?id=2873262fccba12af144ed96ed91be144d92ff2e1
3	Memory corruption vulnerability when reading XWD files	http://git.gnome.org/browse/gimp/commit/?id=2873262fccba12af144ed96ed91be144d92ff2e1
GNOME Bugzilla
4	Bug 687392	https://bugzilla.gnome.org/show_bug.cgi?id=687392
opensuse-security-announce
5	openSUSE-SU-2012:1623	http://lists.opensuse.org/opensuse-updates/2012-12/msg00017.html
Ubuntu Security Notice
6	USN-1659-1	http://www.ubuntu.com/usn/USN-1659-1/

Change Log

No	Changed Details	Date of change
0	[2012年12月19日] 掲載	Feb. 17, 2018, 10:37 a.m.