[USN-7209-1] GIMP DDS Plugin vulnerability

[John Breton]

==========================================================================
Ubuntu Security Notice USN-7209-1
January 16, 2025

gimp-dds vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

The GIMP DDS Plugin could be made to crash or run programs as
your login if it opened a specially crafted file.

Software Description:
- gimp-dds: DDS (DirectDraw Surface) plugin for GIMP

Details:

Jacob Boerema discovered that the GIMP DDS Plugin incorrectly
processed DDS files due to a memory issue. An attacker could
exploit this through a specifically crafted DDS file to cause
GIMP to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
gimp-dds 3.0.1-1+deb10u1build0.22.04.1

Ubuntu 20.04 LTS
gimp-dds 3.0.1-1+deb10u1build0.20.04.1

Ubuntu 18.04 LTS
gimp-dds 3.0.1-1+deb10u1build0.18.04.1~esm1
Available with Ubuntu Pro

Ubuntu 16.04 LTS
gimp-dds 3.0.1-1+deb10u1build0.16.04.1~esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7209-1
CVE-2023-44441

Package Information:
https://launchpad.net/ubuntu/+source/gimp-dds/3.0.1-1+deb10u1build0.22.04.1
https://launchpad.net/ubuntu/+source/gimp-dds/3.0.1-1+deb10u1build0.20.04.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xF294825506581F28.asc
Type: application/pgp-keys
Size: 4833 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20250116/29a4a4aa/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20250116/29a4a4aa/attachment-0001.sig>