Double-Free in GIMP PSP File Parser

Executive Summary

This vulnerability is a double-free flaw in GIMP's Paint Shop Pro (PSP) file format parser, specifically in the read_layer_block() function. During processing of a specially crafted PSP file, a variable named 'name' is allocated, used, and freed in a loop. If an error occurs during the second iteration before memory is allocated for 'name', the pointer from the first iteration is freed again, causing a double-free condition.

This double-free can lead to memory corruption, which may allow an attacker to cause a denial of service or potentially execute arbitrary code on the affected system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to exploit the double-free condition to corrupt memory. This can result in a denial of service, causing the GIMP application to crash or become unstable.

More severely, the memory corruption could be leveraged by an attacker to execute arbitrary code, potentially gaining control over the system running GIMP with the privileges of the user.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a double-free condition in GIMP's PSP file format parser triggered by processing specially crafted PSP files. Detection would involve monitoring or analyzing GIMP's handling of PSP files for crashes or abnormal behavior.

There are no specific commands or network detection methods provided in the available information to detect this vulnerability directly.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update GIMP to the latest version where the fix has been committed upstream.

Avoid opening or processing untrusted or specially crafted PSP files until the patched version is applied.

Useful 0 Not Useful 0