CLD-184 Details

Other IDs this deficiency may be known by:

CVE ID CVE-2017-17788 (nvd) (mitre) (debian) (archlinux) (red hat) (suse) (ubuntu)
Other ID(s)

Basic Information:

Affected Package(s) gimp
Deficiency Type SECURITY
Date Created 2017-12-21 09:50:54
Date Last Modified 2017-12-22 17:49:56

Version Specific Information:

Cucumber 1.0 i686fixed in gimp-2.8.22-i686-3
Cucumber 1.0 x86_64fixed in gimp-2.8.22-x86_64-3 and gimp-lib_i686-2.8.22-lib_i686-3

Cucumber 1.1 i686 fixed in gimp-2.8.22-i686-3
Cucumber 1.1 x86_64 fixed in gimp-2.8.22-x86_64-3 and gimp-lib_i686-2.8.22-lib_i686-3


=================================== Overview ===================================


In GIMP 2.8.22, there is a stack-based buffer over-read in xcf_load_stream in
app/xcf/xcf.c when there is no '\0' character after the version string.

================================ Initial Report ================================

From Hanno Bock on Gnome Bugzilla

I'll attach a file that will cause a stack overread in the XCF file import.
This was discovered by fuzzing with american fuzzy lop and address sanitizer.
I'll also attach the stack trace from asan. The overread can be detected by
compiling gimp with address sanitizer.

The bug is in xcf.c when reading the file version. According to the inofficial
XCF spec [1] the version is a string starting at offset 9 with a null
terminator at offset 13.

The code in xcf.c assumes that this null terminator is there and passes the
version string to atoi. So if you craft a file where it's missing then atoi
will overread. This can be fixed by checking that the null terminator is really
set to 0 and returning an error if it's not. Patch also attached.

See the Bugzilla page for the attachments

============================ Additional Information ============================


================================= Our Analysis =================================

----- Affected Products -----
Versions of GIMP up to and including 2.8.22 that have not had the patch from
are vulnerable to this vulnerability. This includes GIMP as originally packaged
in Cucumber Linux 1.0 and 1.1.

----- Scope and Impact of this Vulnerability -----
This vulnerability can result in the atoi() function performing a buffer

----- Fix for this Vulnerability -----
This vulnerability can be fixed by applying the patch from

================================= Our Solution =================================

We have applied the aforementioned patch and rebuilt GIMP.