|
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:296
http://www.mandriva.com/security/
_______________________________________________________________________
Package : gimp
Date : November 13, 2009
Affected: 2009.1, 2010.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability was discovered and corrected in gimp:
Integer overflow in the ReadImage function in
plug-ins/file-bmp/bmp-read.c in GIMP 2.6.7 might allow remote attackers
to execute arbitrary code via a BMP file with crafted width and height
values that trigger a heap-based buffer overflow (CVE-2009-1570).
This update provides a solution to this vulnerability.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1570
http://secunia.com/secunia_research/2009-42/
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2009.1:
883361c0357f4eada0045fd97fb5efbf 2009.1/i586/gimp-2.6.6-3.1mdv2009.1.i586.rpm
13e8b2b9d8f7fe940caa4306240f15ae 2009.1/i586/gimp-python-2.6.6-3.1mdv2009.1.i586.rpm
ef86532635e5fdc4a18c5a8ba333747a 2009.1/i586/libgimp2.0_0-2.6.6-3.1mdv2009.1.i586.rpm
e706dfdb96e53012aa76e7f2e8b31afc 2009.1/i586/libgimp2.0-devel-2.6.6-3.1mdv2009.1.i586.rpm
ee6089191e32c30b460980599fa4519a 2009.1/SRPMS/gimp-2.6.6-3.1mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
ab041fd27230d29de9f935ddc6534195 2009.1/x86_64/gimp-2.6.6-3.1mdv2009.1.x86_64.rpm
d40cede468a59a403d041e02e50aff10 2009.1/x86_64/gimp-python-2.6.6-3.1mdv2009.1.x86_64.rpm
0a3ab21124ff0bf8471cf999e307cb39 2009.1/x86_64/lib64gimp2.0_0-2.6.6-3.1mdv2009.1.x86_64.rpm
2ff4b0ca8acde92978f218759f2b5245 2009.1/x86_64/lib64gimp2.0-devel-2.6.6-3.1mdv2009.1.x86_64.rpm
ee6089191e32c30b460980599fa4519a 2009.1/SRPMS/gimp-2.6.6-3.1mdv2009.1.src.rpm
Mandriva Linux 2010.0:
8e2057d580d8d5732687d1580b3da6b7 2010.0/i586/gimp-2.6.7-4.1mdv2010.0.i586.rpm
9c4cc91afaba0967bbbfc301214d7065 2010.0/i586/gimp-python-2.6.7-4.1mdv2010.0.i586.rpm
cf6fd4ef23944949095dd2b6dd19193c 2010.0/i586/libgimp2.0_0-2.6.7-4.1mdv2010.0.i586.rpm
ff4531713e2f0d3f07c5dcf6ed212dce 2010.0/i586/libgimp2.0-devel-2.6.7-4.1mdv2010.0.i586.rpm
143714e2ffff6d049c3b62b2d65a0c3c 2010.0/SRPMS/gimp-2.6.7-4.1mdv2010.0.src.rpm
Mandriva Linux 2010.0/X86_64:
0dbc4ee2e958ddfbcb3a9bd4d96f9212 2010.0/x86_64/gimp-2.6.7-4.1mdv2010.0.x86_64.rpm
896b78a5ae1f4d8474629fd2ba80e9f0 2010.0/x86_64/gimp-python-2.6.7-4.1mdv2010.0.x86_64.rpm
d9532b3a4df579c5feab0e9fb1597249 2010.0/x86_64/lib64gimp2.0_0-2.6.7-4.1mdv2010.0.x86_64.rpm
5c1b0b49afca34547cf6d9ade7cbd434 2010.0/x86_64/lib64gimp2.0-devel-2.6.7-4.1mdv2010.0.x86_64.rpm
143714e2ffff6d049c3b62b2d65a0c3c 2010.0/SRPMS/gimp-2.6.7-4.1mdv2010.0.src.rpm
Mandriva Enterprise Server 5:
f50aef592a242933e2755d6635427399 mes5/i586/gimp-2.4.7-1.1mdvmes5.i586.rpm
cea5c73cf0f13d370cbdc48968d14ce7 mes5/i586/gimp-python-2.4.7-1.1mdvmes5.i586.rpm
a8370cf7edf2227fb367c9a1514453ee mes5/i586/libgimp2.0_0-2.4.7-1.1mdvmes5.i586.rpm
e59ca76d659dcdce759b8dfa62a1d9f9 mes5/i586/libgimp2.0-devel-2.4.7-1.1mdvmes5.i586.rpm
37fda93cf9ed71fa29ef3ab116d70769 mes5/SRPMS/gimp-2.4.7-1.1mdvmes5.src.rpm
Mandriva Enterprise Server 5/X86_64:
2e814f6d61b1b34c234a230e2dc925b2 mes5/x86_64/gimp-2.4.7-1.1mdvmes5.x86_64.rpm
dc12989ce4733362d7ef1f6f3bfed0c4 mes5/x86_64/gimp-python-2.4.7-1.1mdvmes5.x86_64.rpm
d4ad33dc97447137e1903790ea8315d8 mes5/x86_64/lib64gimp2.0_0-2.4.7-1.1mdvmes5.x86_64.rpm
10d169f3ee2fcb66b6340e7b9f5b00c4 mes5/x86_64/lib64gimp2.0-devel-2.4.7-1.1mdvmes5.x86_64.rpm
37fda93cf9ed71fa29ef3ab116d70769 mes5/SRPMS/gimp-2.4.7-1.1mdvmes5.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team