Source: gimp Version: 2.8.14-1 Severity: normal Tags: patch security upstream Forwarded: https://bugzilla.gnome.org/show_bug.cgi?id=790783
Hi, the following vulnerability was published for gimp. CVE-2017-17788[0]: | In GIMP 2.8.22, there is a stack-based buffer over-read in | xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after | the version string. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-17788 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17788 [1] https://bugzilla.gnome.org/show_bug.cgi?id=790783 [2] https://git.gnome.org/browse/GIMP/commit/?id=702c4227e8b6169f781e4bb5ae4b5733f51ab126 Please adjust the affected versions in the BTS as needed. Note that prior to upstream commit 63bcc698270bea1c4daa61c94da2c6c23dab87c5 (where xcf_load_stream was factored out), the problematic code is just in the function xcf_load_invoker(). Regards, Salvatore _______________________________________________ Secure-testing-team mailing list Secure-testing-team@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-team
