REDHAT-BUG-2496135: Buffer Overflow
An off-by-one stack buffer overflow exists in GIMP's PNM file format parser. In pnmscannergettoken() in file-pnm.c, the loop condition ctr < bufsize allows ctr to reach bufsize (512), then buf[ctr] = '\0' writes one byte past the 512-byte stack buffer. The function is called from pnmloadascii() with a stack-allocated buf[BUFLEN] where BUFLEN = 512, with no extra room for the null terminator.
- Function: pnmscannergettoken() - File: plug-ins/common/file-pnm.c:2103-2122 - Fix: https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817 - Upstream issue: https://gitlab.gnome.org/GNOME/gimp/-/issues/16206 - Acknowledgment: bb1abu
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2496135?
The severity of REDHAT-BUG-2496135 is medium.
What type of vulnerability is REDHAT-BUG-2496135?
REDHAT-BUG-2496135 is a buffer overflow vulnerability.
How do I fix REDHAT-BUG-2496135?
To fix REDHAT-BUG-2496135, you should apply the latest security updates or patches provided by GIMP.
What is the impact of REDHAT-BUG-2496135?
The impact of REDHAT-BUG-2496135 can lead to potential exploitation via an off-by-one stack buffer overflow.
In which function does the vulnerability REDHAT-BUG-2496135 occur?
The vulnerability REDHAT-BUG-2496135 occurs in the pnmscanner_gettoken() function in file-pnm.c.