Search for packages
Package details: pkg:deb/debian/gimp@2.10.22-4%2Bdeb11u2
purl pkg:deb/debian/gimp@2.10.22-4%2Bdeb11u2
Next non-vulnerable version 2.10.34-1+deb12u3
Latest non-vulnerable version 3.0.4-2
Risk 4.1
Vulnerabilities affecting this package (9)
Vulnerability Summary Fixed by
VCID-8mt1-8xsr-hqbp
Aliases:
CVE-2025-6035
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.4-2
Affected by 0 other vulnerabilities.
VCID-8nms-qdz2-aaaa
Aliases:
CVE-2022-32990
An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS).
2.10.34-1
Affected by 0 other vulnerabilities.
2.10.34-1+deb12u2
Affected by 7 other vulnerabilities.
VCID-9tj3-u7yc-k3eb
Aliases:
CVE-2025-48798
gimp: Multiple use after free in XCF parser
2.10.34-1+deb12u2
Affected by 7 other vulnerabilities.
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.2-3.1
Affected by 1 other vulnerability.
VCID-aaj9-rndw-aaas
Aliases:
CVE-2022-30067
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.
2.10.34-1
Affected by 0 other vulnerabilities.
2.10.34-1+deb12u2
Affected by 7 other vulnerabilities.
VCID-b4dm-z619-rybb
Aliases:
CVE-2025-48796
gimp: Stack-based buffer overflows in file-ico
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.2-3.1
Affected by 1 other vulnerability.
VCID-cdqa-dr3b-8qfx
Aliases:
CVE-2025-2761
GIMP FLI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25100.
2.10.34-1+deb12u2
Affected by 7 other vulnerabilities.
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.2-1
Affected by 0 other vulnerabilities.
3.0.2-2
Affected by 0 other vulnerabilities.
3.0.2-3
Affected by 0 other vulnerabilities.
3.0.2-3.1
Affected by 1 other vulnerability.
VCID-ehgf-mmvw-aaac
Aliases:
CVE-2018-12713
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was intended to be private.
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.2-2
Affected by 0 other vulnerabilities.
3.0.2-3
Affected by 0 other vulnerabilities.
3.0.2-3.1
Affected by 1 other vulnerability.
VCID-g9pb-cgp7-bube
Aliases:
CVE-2025-2760
GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25082.
2.10.34-1+deb12u2
Affected by 7 other vulnerabilities.
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.2-1
Affected by 0 other vulnerabilities.
3.0.2-2
Affected by 0 other vulnerabilities.
3.0.2-3
Affected by 0 other vulnerabilities.
3.0.2-3.1
Affected by 1 other vulnerability.
VCID-vgkt-egfj-3fbx
Aliases:
CVE-2025-48797
gimp: Multiple heap buffer overflows in TGA parser
2.10.34-1+deb12u2
Affected by 7 other vulnerabilities.
2.10.34-1+deb12u3
Affected by 0 other vulnerabilities.
3.0.2-3.1
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (6)
Vulnerability Summary Aliases
VCID-1gay-n1hb-aaap GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096. CVE-2023-44443
VCID-4nrg-y74g-aaab GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094. CVE-2023-44442
VCID-8nms-qdz2-aaaa An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS). CVE-2022-32990
VCID-aaj9-rndw-aaas GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash. CVE-2022-30067
VCID-sh95-tub9-aaaf GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. Crafted data in a PSP file can trigger an off-by-one error when calculating a location to write within a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22097. CVE-2023-44444
VCID-zxxv-uu3f-aaac GIMP DDS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DDS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22093. CVE-2023-44441

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-22T15:21:44.879734+00:00 Debian Importer Fixing VCID-1gay-n1hb-aaap None 36.1.3
2025-06-22T01:51:32.623341+00:00 Debian Importer Fixing VCID-sh95-tub9-aaaf None 36.1.3
2025-06-21T18:44:57.694500+00:00 Debian Oval Importer Fixing VCID-sh95-tub9-aaaf https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.3
2025-06-21T18:11:54.716199+00:00 Debian Oval Importer Fixing VCID-zxxv-uu3f-aaac https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.3
2025-06-21T15:19:26.470211+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 36.1.3
2025-06-21T14:51:36.158590+00:00 Debian Oval Importer Fixing VCID-sh95-tub9-aaaf https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T14:16:52.167997+00:00 Debian Oval Importer Fixing VCID-4nrg-y74g-aaab https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T12:26:26.091283+00:00 Debian Oval Importer Fixing VCID-aaj9-rndw-aaas https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.3
2025-06-21T11:16:21.732318+00:00 Debian Importer Affected by VCID-9tj3-u7yc-k3eb https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T10:42:32.052754+00:00 Debian Importer Fixing VCID-zxxv-uu3f-aaac None 36.1.3
2025-06-21T09:27:22.471453+00:00 Debian Importer Affected by VCID-b4dm-z619-rybb https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T06:22:25.458322+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 36.1.3
2025-06-21T06:01:47.518102+00:00 Debian Importer Affected by VCID-ehgf-mmvw-aaac https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T05:12:06.200131+00:00 Debian Importer Affected by VCID-8mt1-8xsr-hqbp https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T04:33:48.570578+00:00 Debian Importer Affected by VCID-cdqa-dr3b-8qfx https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T02:14:41.061467+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-20T23:56:17.279221+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-20T23:49:39.044664+00:00 Debian Importer Affected by VCID-vgkt-egfj-3fbx https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-20T21:57:09.541296+00:00 Debian Importer Affected by VCID-g9pb-cgp7-bube https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-08T12:11:02.721831+00:00 Debian Oval Importer Fixing VCID-1gay-n1hb-aaap https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T11:14:57.234884+00:00 Debian Oval Importer Fixing VCID-sh95-tub9-aaaf https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T10:43:15.256489+00:00 Debian Oval Importer Fixing VCID-zxxv-uu3f-aaac https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.1.0
2025-06-08T07:45:00.088034+00:00 Debian Oval Importer Fixing VCID-sh95-tub9-aaaf https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T07:10:13.916488+00:00 Debian Oval Importer Fixing VCID-4nrg-y74g-aaab https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-08T05:27:21.302594+00:00 Debian Oval Importer Fixing VCID-aaj9-rndw-aaas https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.1.0
2025-06-01T00:49:00.298343+00:00 Debian Importer Affected by VCID-9tj3-u7yc-k3eb https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-05-31T23:29:10.374807+00:00 Debian Importer Affected by VCID-b4dm-z619-rybb https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-05-31T14:48:50.325179+00:00 Debian Importer Affected by VCID-vgkt-egfj-3fbx https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-05-03T02:59:50.067115+00:00 Debian Importer Affected by VCID-ehgf-mmvw-aaac https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-22T17:25:46.653913+00:00 Debian Importer Affected by VCID-g9pb-cgp7-bube https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-22T08:51:02.849227+00:00 Debian Importer Affected by VCID-cdqa-dr3b-8qfx https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-12T19:16:21.371439+00:00 Debian Oval Importer Fixing VCID-4nrg-y74g-aaab https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T17:56:41.662107+00:00 Debian Oval Importer Fixing VCID-1gay-n1hb-aaap https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T16:58:39.886890+00:00 Debian Oval Importer Fixing VCID-sh95-tub9-aaaf https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-12T16:25:08.241928+00:00 Debian Oval Importer Fixing VCID-zxxv-uu3f-aaac https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-08T06:17:31.558145+00:00 Debian Oval Importer Fixing VCID-sh95-tub9-aaaf https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T05:42:47.864226+00:00 Debian Oval Importer Fixing VCID-4nrg-y74g-aaab https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-08T03:58:34.148532+00:00 Debian Oval Importer Fixing VCID-aaj9-rndw-aaas https://www.debian.org/security/oval/oval-definitions-buster.xml.bz2 36.0.0
2025-04-07T09:58:35.497958+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-07T01:17:22.694288+00:00 Debian Importer Fixing VCID-4nrg-y74g-aaab None 36.0.0
2025-04-06T08:36:36.014030+00:00 Debian Importer Fixing VCID-1gay-n1hb-aaap None 36.0.0
2025-04-05T20:34:22.705740+00:00 Debian Importer Fixing VCID-sh95-tub9-aaaf None 36.0.0
2025-04-05T11:51:13.798369+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 36.0.0
2025-04-05T07:51:45.837130+00:00 Debian Importer Fixing VCID-zxxv-uu3f-aaac None 36.0.0
2025-04-05T03:37:09.546423+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 36.0.0
2025-04-04T05:00:22.307607+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-04T02:37:50.843545+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-02-21T14:04:13.837213+00:00 Debian Importer Fixing VCID-sh95-tub9-aaaf None 35.1.0
2025-02-21T14:04:11.693790+00:00 Debian Importer Fixing VCID-1gay-n1hb-aaap None 35.1.0
2025-02-21T14:04:09.230972+00:00 Debian Importer Fixing VCID-4nrg-y74g-aaab None 35.1.0
2025-02-21T14:04:06.922973+00:00 Debian Importer Fixing VCID-zxxv-uu3f-aaac None 35.1.0
2025-02-20T22:25:16.583701+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-20T22:25:13.842819+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-20T22:25:13.154603+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 35.1.0
2025-02-20T20:49:50.118223+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-20T20:49:48.040525+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 35.1.0
2024-11-23T14:34:03.055624+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-23T14:34:01.015939+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-23T14:34:00.318575+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 35.0.0
2024-11-23T13:11:44.448863+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-23T13:11:42.403897+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 35.0.0
2024-10-10T12:25:16.932356+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-10-10T12:25:14.786500+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-10-10T12:25:14.083706+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 34.0.2
2024-10-10T11:05:53.240119+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-10-10T11:05:51.144415+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 34.0.2
2024-09-19T18:53:46.828628+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-09-19T18:53:45.437445+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-09-19T18:53:44.736657+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 34.0.1
2024-09-19T17:47:48.608863+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-09-19T17:47:46.517648+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 34.0.1
2024-04-26T05:23:53.315213+00:00 Debian Importer Fixing VCID-sh95-tub9-aaaf None 34.0.0rc4
2024-04-26T05:23:51.591700+00:00 Debian Importer Fixing VCID-1gay-n1hb-aaap None 34.0.0rc4
2024-04-26T05:23:49.417809+00:00 Debian Importer Fixing VCID-4nrg-y74g-aaab None 34.0.0rc4
2024-04-26T05:23:43.887890+00:00 Debian Importer Fixing VCID-zxxv-uu3f-aaac None 34.0.0rc4
2024-04-25T15:52:09.172370+00:00 Debian Importer Affected by VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.0rc4
2024-04-25T15:52:08.324642+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.0rc4
2024-04-25T15:52:07.501687+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 34.0.0rc4
2024-04-25T14:35:01.702855+00:00 Debian Importer Affected by VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 34.0.0rc4
2024-04-25T14:34:59.166671+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 34.0.0rc4
2024-01-11T18:36:38.362213+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.0rc2
2024-01-11T18:36:37.537626+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 34.0.0rc2
2024-01-11T16:11:23.790528+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 34.0.0rc2
2024-01-11T16:11:22.988086+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 34.0.0rc2
2024-01-05T09:53:10.688635+00:00 Debian Importer Fixing VCID-sh95-tub9-aaaf None 34.0.0rc1
2024-01-05T09:53:09.070225+00:00 Debian Importer Fixing VCID-1gay-n1hb-aaap None 34.0.0rc1
2024-01-05T09:53:07.136158+00:00 Debian Importer Fixing VCID-4nrg-y74g-aaab None 34.0.0rc1
2024-01-05T09:53:05.420594+00:00 Debian Importer Fixing VCID-zxxv-uu3f-aaac None 34.0.0rc1
2024-01-05T02:35:39.714820+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa https://security-tracker.debian.org/tracker/data/json 34.0.0rc1
2024-01-05T02:35:38.882356+00:00 Debian Importer Fixing VCID-8nms-qdz2-aaaa None 34.0.0rc1
2024-01-05T01:32:25.403716+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas None 34.0.0rc1
2024-01-05T01:32:24.427019+00:00 Debian Importer Fixing VCID-aaj9-rndw-aaas https://security-tracker.debian.org/tracker/data/json 34.0.0rc1