CVE-2012-3236

MEDIUM 4.3CVE-2012-3236 · Published 12/07/2012 · updated 16/06/2026

Package	Affected versions	Patched versions
gimp gimp	`< 2.9.2`	`2.9.2`

Description

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.

References

archives.neohapsis.com/archives/bugtraq/2012-06/0192.html · Broken Link
git.gnome.org/browse/gimp/commit/plug-ins/file-fits/fits-io.c · Exploit
lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.html · Third Party Advisory
exploit-db.com/exploits/19482 · Exploit
mandriva.com/security/advisories · Broken Link
reactionpenetrationtesting.co.uk/FIT-file-handling-dos.html · Exploit
securityfocus.com/bid/54246 · Broken Link
ubuntu.com/usn/USN-1559-1 · Third Party Advisory
bugzilla.gnome.org/show_bug.cgi · Issue Tracking
exchange.xforce.ibmcloud.com/vulnerabilities/76658 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free