CVE-2012-3236
NoneCVSS
—
EPSS
10.7%
Published
Jul 12, 2012
CISA due date
—
The record
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | gimp | 0 | 2.8.2-1 |
| Debian:11 | gimp | 0 | 2.8.2-1 |
| Debian:12 | gimp | 0 | 2.8.2-1 |
| Debian:13 | gimp | 0 | 2.8.2-1 |
| openSUSE:Tumbleweed | gimp | 0 | 2.8.18-1.4 |
Related vulnerabilities
- CVE-2023-44444 GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. Also affects gimp
- CVE-2023-44442 GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2017-17784 In GIMP 2.8.22, there is a heap-based buffer over-read in load_image in… Also affects gimp
- CVE-2012-2763 Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in… Also affects gimp
- CVE-2010-4543 Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint… Also affects gimp
- CVE-2025-5473 GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2025-2760 GIMP XWD File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp
- CVE-2023-44443 GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. Also affects gimp