Hello community, here is the log from the commit of package gimp for openSUSE:Factory checked in at 2016-07-01 09:54:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gimp (Old) and /work/SRC/openSUSE:Factory/.gimp.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gimp" Changes: -------- --- /work/SRC/openSUSE:Factory/gimp/gimp.changes 2015-12-09 22:17:39.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.gimp.new/gimp.changes 2016-07-01 09:55:00.000000000 +0200 @@ -1,0 +2,7 @@ +Thu Jun 23 09:25:51 UTC 2016 - zai...@opensuse.org + +- Fix CVE-2016-4994 (boo#986021, bgo#767873): + + Add gimp-Multiple-Use-After-Free.patch: Multiple Use-After-Free + when parsing XCF channel and layer properties. + +------------------------------------------------------------------- New: ---- gimp-Multiple-Use-After-Free.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gimp.spec ++++++ --- /var/tmp/diff_new_pack.nKmffW/_old 2016-07-01 09:55:01.000000000 +0200 +++ /var/tmp/diff_new_pack.nKmffW/_new 2016-07-01 09:55:01.000000000 +0200 @@ -31,6 +31,8 @@ # openSUSE palette file Source2: openSUSE.gpl Source99: baselibs.conf +# PATCH-FIX-UPSTREAM gimp-Multiple-Use-After-Free.patch boo#986021 bgo#767873 zai...@opensuse.org -- Fix CVE-2016-4994 +Patch0: gimp-Multiple-Use-After-Free.patch BuildRequires: aalib-devel BuildRequires: alsa-devel >= 1.0.0 BuildRequires: babl-devel >= 0.1.10 @@ -225,6 +227,7 @@ %lang_package %prep %setup -q +%patch0 -p1 translation-update-upstream translation-update-upstream po-libgimp gimp20-libgimp translation-update-upstream po-python gimp20-python ++++++ gimp-Multiple-Use-After-Free.patch ++++++ >From e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f Mon Sep 17 00:00:00 2001 From: Shmuel H <shmuelg...@gmail.com> Date: Mon, 20 Jun 2016 17:14:41 +0300 Subject: Bug 767873 - (CVE-2016-4994) Multiple Use-After-Free when parsing... ...XCF channel and layer properties The properties PROP_ACTIVE_LAYER, PROP_FLOATING_SELECTION, PROP_ACTIVE_CHANNEL saves the current object pointer the @info structure. Others like PROP_SELECTION (for channel) and PROP_GROUP_ITEM (for layer) will delete the current object and create a new object, leaving the pointers in @info invalid (dangling). Therefore, if a property from the first type will come before the second, the result will be an UaF in the last lines of xcf_load_image (when it actually using the pointers from @info). I wasn't able to exploit this bug because that g_object_instance->c_class gets cleared by the last g_object_unref and GIMP_IS_{LAYER,CHANNEL} detects that and return FALSE. (cherry picked from commit 6d804bf9ae77bc86a0a97f9b944a129844df9395) --- app/xcf/xcf-load.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/app/xcf/xcf-load.c b/app/xcf/xcf-load.c index b180377..67cc6d4 100644 --- a/app/xcf/xcf-load.c +++ b/app/xcf/xcf-load.c @@ -904,6 +904,18 @@ xcf_load_layer_props (XcfInfo *info, case PROP_GROUP_ITEM: { GimpLayer *group; + gboolean is_active_layer; + + /* We're going to delete *layer, Don't leave its pointers + * in @info. After that, we'll restore them back with the + * new pointer. See bug #767873. + */ + is_active_layer = (*layer == info->active_layer); + if (is_active_layer) + info->active_layer = NULL; + + if (*layer == info->floating_sel) + info->floating_sel = NULL; group = gimp_group_layer_new (image); @@ -916,6 +928,13 @@ xcf_load_layer_props (XcfInfo *info, g_object_ref_sink (*layer); g_object_unref (*layer); *layer = group; + + if (is_active_layer) + info->active_layer = *layer; + + /* Don't restore info->floating_sel because group layers + * can't be floating selections + */ } break; @@ -986,6 +1005,12 @@ xcf_load_channel_props (XcfInfo *info, { GimpChannel *mask; + /* We're going to delete *channel, Don't leave its pointer + * in @info. See bug #767873. + */ + if (*channel == info->active_channel) + info->active_channel = NULL; + mask = gimp_selection_new (image, gimp_item_get_width (GIMP_ITEM (*channel)), @@ -1000,6 +1025,10 @@ xcf_load_channel_props (XcfInfo *info, *channel = mask; (*channel)->boundary_known = FALSE; (*channel)->bounds_known = FALSE; + + /* Don't restore info->active_channel because the + * selection can't be the active channel + */ } break; -- cgit v0.12