[Secure-testing-team] Bug#885347: gimp: CVE-2017-17788: buffer overread in XCF parser if version field has no null terminator

[Salvatore Bonaccorso]

Source: gimp
Version: 2.8.14-1
Severity: normal
Tags: patch security upstream
Forwarded: https://bugzilla.gnome.org/show_bug.cgi?id=790783

Hi,

the following vulnerability was published for gimp.

CVE-2017-17788[0]:
| In GIMP 2.8.22, there is a stack-based buffer over-read in
| xcf_load_stream in app/xcf/xcf.c when there is no '\0' character after
| the version string.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17788
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17788
[1] https://bugzilla.gnome.org/show_bug.cgi?id=790783
[2] https://git.gnome.org/browse/GIMP/commit/?id=702c4227e8b6169f781e4bb5ae4b5733f51ab126

Please adjust the affected versions in the BTS as needed. Note that
prior to upstream commit 63bcc698270bea1c4daa61c94da2c6c23dab87c5
(where xcf_load_stream was factored out), the problematic code is just
in the function xcf_load_invoker().

Regards,
Salvatore