SUSE-SU-2020:3940-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2020:3940-1

LOW3.3

Security update for gimp

Published Dec 28, 2020

Modified 5 years ago

Fix available

Details

Description of the patch:

This update for gimp fixes the following issues:

Security issue fixed:

CVE-2017-17787: Fixed an out-of-bounds read in the PSP importer (bsc#1073628).

Non-security issue fixed:

Fixed a software crash while importing a PostScript file (bsc#1178726).

Affected Packages

gimp

SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server for SAP Applications 15 SP1SUSE Linux Enterprise Workstation Extension 15 SP1

Fixed in:

2.8.22-5.8.1

gimp-devel

SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server for SAP Applications 15 SP1SUSE Linux Enterprise Workstation Extension 15 SP1

Fixed in:

2.8.22-5.8.1

gimp-lang

SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server for SAP Applications 15 SP1SUSE Linux Enterprise Workstation Extension 15 SP1

Fixed in:

2.8.22-5.8.1

gimp-plugins-python

SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server for SAP Applications 15 SP1SUSE Linux Enterprise Workstation Extension 15 SP1

Fixed in:

2.8.22-5.8.1

libgimp-2_0-0

SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server for SAP Applications 15 SP1SUSE Linux Enterprise Workstation Extension 15 SP1

Fixed in:

2.8.22-5.8.1

libgimpui-2_0-0

SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Server 15 SP1SUSE Linux Enterprise Server for SAP Applications 15 SP1SUSE Linux Enterprise Workstation Extension 15 SP1

Fixed in:

2.8.22-5.8.1

References

https://bugzilla.suse.com/1073628

https://bugzilla.suse.com/1178726

https://lists.suse.com/pipermail/sle-security-updates/2020-December/008124.html

https://www.suse.com/security/cve/CVE-2017-17787/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2020/suse-su-20203940-1/

CVSS Analysis

CVSS v3.0

3.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

3.3/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Upstream

Ecosystems

SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Workstation Extension 15 SP1

Timeline

PublishedDec 28, 2020

ModifiedDec 28, 2020