CVE-2012-3236

fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

10.75% chance of exploitation in the next 30 days, 96th percentile

Published

2012-07-12

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/19482

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/19482

Security advisories

• http://git.gnome.org/browse/gimp/commit/plug-ins/file-fits/fits-io.c?id=ace45631595e8781a…
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00000.html
• http://www.reactionpenetrationtesting.co.uk/FIT-file-handling-dos.html
• http://www.securityfocus.com/bid/54246
• http://www.ubuntu.com/usn/USN-1559-1
• https://bugzilla.gnome.org/show_bug.cgi?id=676804
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76658
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:082

References

• CVE Record
• NVD entry