Search for vulnerabilities
Vulnerability details: VCID-k9ry-jtz4-aaaf
Vulnerability ID VCID-k9ry-jtz4-aaaf
Aliases CVE-2007-2949
Summary Integer overflow in the seek_to_and_unpack_pixeldata function in the psd.c plugin in Gimp 2.2.15 allows remote attackers to execute arbitrary code via a crafted PSD file that contains a large (1) width or (2) height value.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-190 Integer Overflow or Wraparound
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2007:0513
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.2589 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.32609 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.32609 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.34736 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.36809 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.36809 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.36809 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.36809 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
epss 0.50108 https://api.first.org/data/v1/epss?cve=CVE-2007-2949
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=244400
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2007-2949
Reference id Reference type URL
http://issues.foresightlinux.org/browse/FL-457
http://osvdb.org/37804
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-2949.json
https://api.first.org/data/v1/epss?cve=CVE-2007-2949
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2949
http://secunia.com/advisories/25677
http://secunia.com/advisories/25949
http://secunia.com/advisories/26044
http://secunia.com/advisories/26132
http://secunia.com/advisories/26215
http://secunia.com/advisories/26384
http://secunia.com/advisories/26575
http://secunia.com/advisories/26939
http://secunia.com/advisories/28114
http://secunia.com/secunia_research/2007-63/advisory/
http://security.gentoo.org/glsa/glsa-200707-09.xml
https://exchange.xforce.ibmcloud.com/vulnerabilities/35246
https://issues.rpath.com/browse/RPL-1487
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11276
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5772
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103170-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-201320-1
http://svn.gnome.org/viewcvs/gimp?view=revision&revision=22798
http://www.debian.org/security/2007/dsa-1335
http://www.kb.cert.org/vuls/id/399896
http://www.mandriva.com/security/advisories?name=MDKSA-2007:170
http://www.novell.com/linux/security/advisories/2007_15_sr.html
http://www.redhat.com/support/errata/RHSA-2007-0513.html
http://www.securityfocus.com/bid/24745
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.360191
http://www.ubuntu.com/usn/usn-480-1
http://www.vupen.com/english/advisories/2007/2421
http://www.vupen.com/english/advisories/2007/4241
244400 https://bugzilla.redhat.com/show_bug.cgi?id=244400
cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
CVE-2007-2949 https://nvd.nist.gov/vuln/detail/CVE-2007-2949
GLSA-200707-09 https://security.gentoo.org/glsa/200707-09
RHSA-2007:0513 https://access.redhat.com/errata/RHSA-2007:0513
USN-480-1 https://usn.ubuntu.com/480-1/
No exploits are available.
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2007-2949
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.95809
EPSS Score 0.2589
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.