According to the version of the gimp, gimp-help packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Multiple use-after-free vulnerabilities were found in     GIMP in the channel and layer properties parsing     process when loading XCF files.An attacker could create     a specially crafted XCF file which could cause GIMP to     crash. (CVE-2016-4994)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

gimp 和 gimp-help 的更新现在可用于 Red Hat Enterprise Linux 7。Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。GIMP（GNU 图像处理程序）是图像合成和编辑程序。GIMP 是个大型的图像处理工具箱，其中包含通道操作和图层、效果、子像素图像处理和消除锯齿及转换等工具，且一律支持多层级撤销操作。下列程序包已升级至更新的上游版本：gimp (2.8.16)、gimp-help (2.8.2)。(BZ#1298226, BZ#1370595) 安全修复：* 加载 XCF 文件时，在 GIMP 的通道和图层属性分析处理程序中发现多个释放后使用漏洞。攻击者可创建特制的 XCF 文件，而该文件会造成 GIMP 崩溃。(CVE-2016-4994) 其他更改：如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.3 版本说明。

GIMP 团队报告：

在 xcf_load_image 函数中发现一个释放后使用漏洞。

已发现 Gimp（GNU 图像处理程序）中的通道和层属性解析进程中有一个释放后使用漏洞。

对于 Debian 7“Wheezy”，已在 gimp 版本 2.8.2-2+deb7u2 中修复此问题。

建议您升级 gimp 程序包。

注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

gimp 已更新，修复了一个安全问题。修复了此安全问题：

- CVE-2016-4994：通道和层属性解析进程中存在释放后使用漏洞 (bsc#986021)。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

GIMP 團隊報告：

在 xcf_load_image 函式中發現一個釋放後使用弱點。

gimp 已更新，修正了一個安全性問題。已修正此安全性問題：

- CVE-2016-4994：通道和層內容剖析處理程序中存有釋放後使用弱點 (bsc#986021)。

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

現已提供適用於 Red Hat Enterprise Linux 7 的 gimp 和 gimp-help 更新。Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。GIMP (GNU 影像處理程式) 是一種影像合成和編輯程式。GIMP 是一個大型的影像處理工具箱，裡面包含色頻操作和圖層、效果、子像素影像處理和消除鋸齒及轉換等工具，且全部支援多重復原操作。下列套件已升級至更新的上游版本：gimp (2.8.16)、gimp-help (2.8.2)。(BZ#1298226、BZ#1370595) 安全性修正：* 載入 XCF 檔案時，在 GIMP 的色頻和圖層屬性剖析處理程序中發現多個釋放後使用弱點。攻擊者可建立特製的 XCF 檔案，而該檔案會造成 GIMP 損毀。(CVE-2016-4994) 其他變更：如需有關此發行版本的詳細變更資訊，請參閱可從〈參照〉一節連結的 Red Hat Enterprise Linux 7.3 版本資訊。

據發現，Gimp (GNU 影像操作程式) 中的通道和圖層屬性剖析處理程序有一個釋放後使用弱點。

針對 Debian 7「Wheezy」，此問題已於 gimp 的 2.8.2-2+deb7u2 版中修正。

建議您升級 gimp 套件。

注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

According to the versions of the gimp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple use-after-free vulnerabilities were found in     GIMP in the channel and layer properties parsing     process when loading XCF files.An attacker could create     a specially crafted XCF file which could cause GIMP to     crash. (CVE-2016-4994)

  - GIMP through 2.10.2 makes g_get_tmp_dir calls to     establish temporary filenames, which may result in a     filename that already exists, as demonstrated by the     gimp_write_and_read_file function in     app/tests/test-xcf.c. This might be leveraged by     attackers to overwrite files or read file content that     was intended to be private.(CVE-2018-12713)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gimp: Use-after-free vulnerabilities in the channel and layer properties parsing process (CVE-2016-4994)

  - The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to     execute arbitrary commands via the python-fu-eval command. (CVE-2012-4245)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The following packages have been upgraded to a newer upstream version:
gimp (2.8.16), gimp-help (2.8.2).

Security Fix(es) :

  - Multiple use-after-free vulnerabilities were found in     GIMP in the channel and layer properties parsing process     when loading XCF files. An attacker could create a     specially crafted XCF file which could cause GIMP to     crash. (CVE-2016-4994)

Additional Changes :

An update for gimp and gimp-help is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo.

The following packages have been upgraded to a newer upstream version:
gimp (2.8.16), gimp-help (2.8.2). (BZ#1298226, BZ#1370595)

Security Fix(es) :

* Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files.
An attacker could create a specially crafted XCF file which could cause GIMP to crash. (CVE-2016-4994)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

It was discovered that GIMP incorrectly handled malformed XCF files.
If a user were tricked into opening a specially crafted XCF file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
99835	EulerOS 2.0 SP1 : gimp, gimp-help (EulerOS-SA-2016-1075)	Nessus	Huawei Local Security Checks	2017/5/1	2021/1/6	high
94552	RHEL 7：gimp (RHSA-2016:2589)	Nessus	Red Hat Local Security Checks	2016/11/4	2019/10/24	high
92651	FreeBSD：GIMP -- 释放后使用漏洞 (6fb8a90f-c9d5-4d14-b940-aed3d63c2edc)	Nessus	FreeBSD Local Security Checks	2016/8/1	2021/1/4	high
91831	Debian DLA-525-1：gimp 安全更新	Nessus	Debian Local Security Checks	2016/6/27	2021/1/11	high
93190	SUSE SLED12 安全更新：gimp (SUSE-SU-2016:1962-1)	Nessus	SuSE Local Security Checks	2016/8/29	2021/1/6	high
92651	FreeBSD：GIMP -- 釋放後使用弱點 (6fb8a90f-c9d5-4d14-b940-aed3d63c2edc)	Nessus	FreeBSD Local Security Checks	2016/8/1	2021/1/4	high
93190	SUSE SLED12 安全性更新：gimp (SUSE-SU-2016:1962-1)	Nessus	SuSE Local Security Checks	2016/8/29	2021/1/6	high
94552	RHEL 7：gimp (RHSA-2016:2589)	Nessus	Red Hat Local Security Checks	2016/11/4	2019/10/24	high
91831	Debian DLA-525-1：gimp 安全性更新	Nessus	Debian Local Security Checks	2016/6/27	2021/1/11	high
129214	EulerOS 2.0 SP3 : gimp (EulerOS-SA-2019-2021)	Nessus	Huawei Local Security Checks	2019/9/24	2022/5/19	critical
198378	RHEL 5 : gimp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
95839	Scientific Linux Security Update : gimp on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2021/1/14	high
95335	CentOS 7 : gimp / gimp-help (CESA-2016:2589)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	high
91955	Ubuntu 14.04 LTS : GIMP vulnerability (USN-3025-1)	Nessus	Ubuntu Local Security Checks	2016/7/6	2023/10/20	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

critical

high

high

high

high