U radu programskog paketa GIMP (eng. GNU Image Manipulation Program) uočeno je više sigurnosnih nedostataka koji udaljenom napadaču omogućuju izvođenje napada uskraćivanja usluge ili pokretanje proizvoljnog programskog koda.
Paket:
gimp 2.x
Operacijski sustavi:
Fedora 15
Kritičnost:
8.1
Problem:
pogreška u programskoj funkciji, preljev međuspremnika
Nedostaci se očituju u prepisivanju spremnika na stogu u funkcijama "loadit", "gfig_read_parameter_gimp_rgb", "load_preset_response" te "read_channel_data".
Posljedica:
Napadač može iskoristiti navedene propuste za izvođenje DoS (eng. Denial of Service) napada ili izvršavanje zlonamjernog programskog koda.
Rješenje:
Svim se korisnicima savjetuje instalacija novih programskih rješenja.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-7371
2011-05-25 01:53:59
--------------------------------------------------------------------------------
Name : gimp
Product : Fedora 15
Version : 2.6.11
Release : 14.fc15
URL : http://www.gimp.org/
Summary : GNU Image Manipulation Program
Description :
GIMP (GNU Image Manipulation Program) is a powerful image composition and
editing program, which can be extremely useful for creating logos and other
graphics for webpages. GIMP has many of the tools and filters you would expect
to find in similar commercial offerings, and some interesting extras as well.
GIMP provides a large image manipulation toolbox, including channel operations
and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all
with multi-level undo.
--------------------------------------------------------------------------------
Update Information:
This update fixes buffer overflows in the PSP (CVE-2010-4543, CVE-2011-1782),
sphere-designer (CVE-2010-4541), gfig (CVE-2010-4542) and lighting
(CVE-2010-4540) plugins.
--------------------------------------------------------------------------------
ChangeLog:
* Mon May 23 2011 Nils Philippsen <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2:2.6.11-14
- fix buffer overflows in sphere-designer (CVE-2010-4541),
gfig (CVE-2010-4542), lighting (CVE-2010-4540) plugins
* Mon May 23 2011 Nils Philippsen <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 2:2.6.11-13
- harden PSP plugin against bogus input data (CVE-2010-4543, CVE-2011-1782)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #706939 - CVE-2010-4540 CVE-2010-4541 CVE-2010-4542 CVE-2010-4543
CVE-2011-1782 CVE-2010-4543 gimp various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=706939
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update gimp' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke