Search for vulnerabilities
Vulnerability details: VCID-wk1n-5eef-aaan
Vulnerability ID VCID-wk1n-5eef-aaan
Aliases CVE-2006-3404
Summary Buffer overflow in the xcf_load_vector function in app/xcf/xcf-load.c for gimp before 2.2.12 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XCF file with a large num_axes value in the VECTORS property.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2006:0598
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.00984 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01259 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01259 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01259 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01259 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01905 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01905 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.01939 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
epss 0.02342 https://api.first.org/data/v1/epss?cve=CVE-2006-3404
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1618141
cvssv2 5.1 https://nvd.nist.gov/vuln/detail/CVE-2006-3404
Reference id Reference type URL
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=377049
http://bugzilla.gnome.org/show_bug.cgi?id=346742
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2006-3404.json
https://api.first.org/data/v1/epss?cve=CVE-2006-3404
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3404
http://secunia.com/advisories/20976
http://secunia.com/advisories/20979
http://secunia.com/advisories/21069
http://secunia.com/advisories/21104
http://secunia.com/advisories/21170
http://secunia.com/advisories/21182
http://secunia.com/advisories/21198
http://secunia.com/advisories/21459
http://secunia.com/advisories/23044
http://security.gentoo.org/glsa/glsa-200607-08.xml
http://securitytracker.com/id?1016527
https://exchange.xforce.ibmcloud.com/vulnerabilities/27687
https://issues.rpath.com/browse/RPL-522
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11259
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5908
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102720-1
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200070-1
http://www.debian.org/security/2006/dsa-1116
http://www.mandriva.com/security/advisories?name=MDKSA-2006:127
http://www.novell.com/linux/security/advisories/2006_19_sr.html
http://www.osvdb.org/27037
http://www.redhat.com/support/errata/RHSA-2006-0598.html
http://www.securityfocus.com/archive/1/440987/100/0/threaded
http://www.securityfocus.com/archive/1/441012/100/0/threaded
http://www.securityfocus.com/archive/1/441030/100/0/threaded
http://www.securityfocus.com/bid/18877
http://www.ubuntu.com/usn/usn-312-1
http://www.vupen.com/english/advisories/2006/2703
http://www.vupen.com/english/advisories/2006/4634
1618141 https://bugzilla.redhat.com/show_bug.cgi?id=1618141
377049 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=377049
cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gimp:gimp:*:*:*:*:*:*:*:*
CVE-2006-3404 https://nvd.nist.gov/vuln/detail/CVE-2006-3404
GLSA-200607-08 https://security.gentoo.org/glsa/200607-08
RHSA-2006:0598 https://access.redhat.com/errata/RHSA-2006:0598
USN-312-1 https://usn.ubuntu.com/312-1/
No exploits are available.
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2006-3404
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.83908
EPSS Score 0.00984
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.