Security update for gimp SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0601-1 Final 1 1 2020-03-06T08:45:43Z current 2020-03-06T08:45:43Z 2020-03-06T08:45:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for gimp This update for gimp fixes the following issues: - Fix for crashing due to segmentation fault caused by importing ghostscript files. (bsc#1161998) Security issues fixed: - CVE-2017-17785: Fixed an heap-based buffer overflow in FLI import (bsc#1073625) - CVE-2017-17786: Fixed an out-of-bounds read in TGA (bsc#1073626) - CVE-2017-17788: Fixed an out-of-bounds read in XCF (bsc#1073629) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-601,SUSE-SLE-DESKTOP-12-SP4-2020-601,SUSE-SLE-SDK-12-SP4-2020-601,SUSE-SLE-SDK-12-SP5-2020-601,SUSE-SLE-WE-12-SP4-2020-601,SUSE-SLE-WE-12-SP5-2020-601 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200601-1/ Link for SUSE-SU-2020:0601-1 https://lists.suse.com/pipermail/sle-security-updates/2020-March/006584.html E-Mail link for SUSE-SU-2020:0601-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1073625 SUSE Bug 1073625 https://bugzilla.suse.com/1073626 SUSE Bug 1073626 https://bugzilla.suse.com/1073629 SUSE Bug 1073629 https://bugzilla.suse.com/1161998 SUSE Bug 1161998 https://www.suse.com/security/cve/CVE-2017-17785/ SUSE CVE CVE-2017-17785 page https://www.suse.com/security/cve/CVE-2017-17786/ SUSE CVE CVE-2017-17786 page https://www.suse.com/security/cve/CVE-2017-17788/ SUSE CVE CVE-2017-17788 page SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP4 SUSE Linux Enterprise Workstation Extension 12 SP5 gimp-2.8.18-9.8.1 gimp-devel-2.8.18-9.8.1 gimp-lang-2.8.18-9.8.1 gimp-plugin-aa-2.8.18-9.8.1 gimp-plugins-python-2.8.18-9.8.1 libgimp-2_0-0-2.8.18-9.8.1 libgimp-2_0-0-32bit-2.8.18-9.8.1 libgimp-2_0-0-64bit-2.8.18-9.8.1 libgimpui-2_0-0-2.8.18-9.8.1 libgimpui-2_0-0-32bit-2.8.18-9.8.1 libgimpui-2_0-0-64bit-2.8.18-9.8.1 gimp-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 gimp-lang-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 gimp-plugins-python-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 libgimp-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 libgimpui-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Desktop 12 SP4 gimp-devel-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libgimp-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 libgimpui-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 gimp-devel-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libgimp-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libgimpui-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 gimp-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 gimp-lang-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 gimp-plugins-python-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libgimp-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libgimpui-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 gimp-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 gimp-lang-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 gimp-plugins-python-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libgimp-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libgimpui-2_0-0-2.8.18-9.8.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 In GIMP 2.8.22, there is a heap-based buffer overflow in the fli_read_brun function in plug-ins/file-fli/fli.c. CVE-2017-17785 SUSE Linux Enterprise Desktop 12 SP4:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gimp-devel-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gimp-devel-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgimpui-2_0-0-2.8.18-9.8.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200601-1/ https://www.suse.com/security/cve/CVE-2017-17785.html CVE-2017-17785 https://bugzilla.suse.com/1073625 SUSE Bug 1073625 In GIMP 2.8.22, there is a heap-based buffer over-read in ReadImage in plug-ins/common/file-tga.c (related to bgr2rgb.part.1) via an unexpected bits-per-pixel value for an RGBA image. CVE-2017-17786 SUSE Linux Enterprise Desktop 12 SP4:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gimp-devel-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gimp-devel-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgimpui-2_0-0-2.8.18-9.8.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200601-1/ https://www.suse.com/security/cve/CVE-2017-17786.html CVE-2017-17786 https://bugzilla.suse.com/1073626 SUSE Bug 1073626 In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after the version string. CVE-2017-17788 SUSE Linux Enterprise Desktop 12 SP4:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Desktop 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:gimp-devel-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:gimp-devel-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libgimpui-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-lang-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:gimp-plugins-python-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgimp-2_0-0-2.8.18-9.8.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libgimpui-2_0-0-2.8.18-9.8.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200601-1/ https://www.suse.com/security/cve/CVE-2017-17788.html CVE-2017-17788 https://bugzilla.suse.com/1073629 SUSE Bug 1073629