Integer Overflow in GIMP PSD Parser Leads to Memory Corruption

Executive Summary

This vulnerability is an integer overflow in the read_RLE_channel() function of GIMP's PSD parser. Specifically, the function allocates memory for a row-length table using unchecked arithmetic, which can cause the allocated size to be smaller than needed. When a maliciously crafted PSD file exploits this, subsequent writes to the heap memory go beyond the allocated space, causing heap memory corruption.

This memory corruption can lead to serious issues such as denial of service or even arbitrary code execution, meaning an attacker could potentially run malicious code on the affected system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by causing your GIMP application to crash (denial of service) or, more severely, allow an attacker to execute arbitrary code on your system. This could compromise the security and stability of your device, potentially leading to unauthorized access or control.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an integer overflow in GIMP's PSD parser, specifically in the read_RLE_channel() function when processing PSD files. Detection would primarily involve monitoring for the presence of vulnerable GIMP versions or analyzing PSD files for malicious crafting.

There are no specific detection commands or network signatures provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update GIMP to a version that includes the fix committed upstream. The fix addresses the integer overflow in the PSD parser by correcting the allocation logic in the read_RLE_channel() function.

Avoid opening untrusted or suspicious PSD files with GIMP until the update is applied, as these files could exploit the vulnerability to cause memory corruption or arbitrary code execution.

Useful 0 Not Useful 0