Vulnerability Name:

CVE-2013-1978 (CCN-89470)

Assigned:2013-12-03
Published:2013-12-03
Updated:2023-02-13
Summary:Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-122
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2013-1978

Source: secalert@redhat.com
Type: Third Party Advisory, Vendor Advisory
secalert@redhat.com

Source: CCN
Type: SA55908
GIMP XWD Plugin "load_image()" Buffer Overflow Vulnerability

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: DEBIAN
Type: DSA-2813
gimp -- several vulnerabilities

Source: CCN
Type: GIMP Web site
GIMP - The GNU Image Manipulation Program

Source: CCN
Type: BID-64098
GIMP XWD File Handling Heap Buffer Overflow Vulnerability

Source: secalert@redhat.com
Type: Broken Link, VDB Entry
secalert@redhat.com

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: Red Hat Bugzilla Bug 953902
(CVE-2013-1978) CVE-2013-1978 gimp: XWD plugin color map heap-based buffer overflow

Source: secalert@redhat.com
Type: Issue Tracking, Third Party Advisory
secalert@redhat.com

Source: XF
Type: UNKNOWN
gimp-cve20131978-bo(89470)

Source: secalert@redhat.com
Type: Third Party Advisory
secalert@redhat.com

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-1978

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*
    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*
    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*
    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gimp:gimp:2.8.10:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:26164
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:20131978
    V
    		CVE-2013-1978
    2021-08-15
    oval:org.opensuse.security:def:55927
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:36411
    P
    		gimp-2.6.2-3.34.45.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:55889
    P
    		Security update for libnettle (Important)
    2021-04-28
    oval:org.opensuse.security:def:26036
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:56008
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:25972
    P
    		Security update for postgresql12 (Important)
    2020-12-04
    oval:org.opensuse.security:def:26379
    P
    		Security update for irssi (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27021
    P
    		pyxml on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27246
    P
    		nagios-nrpe on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27876
    P
    		Security update for sendmail
    2020-12-01
    oval:org.opensuse.security:def:55330
    P
    		mipv6d on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57358
    P
    		Security update for gimp
    2020-12-01
    oval:org.opensuse.security:def:26302
    P
    		Security update for python-PyYAML (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27374
    P
    		bind-devel-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26507
    P
    		Security update for cacti, cacti-spine (Important)
    2020-12-01
    oval:org.opensuse.security:def:27035
    P
    		sudo on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27257
    P
    		pam_krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27925
    P
    		Security update for Botan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54484
    P
    		gnutls on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55615
    P
    		Security update for elfutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26386
    P
    		Security update for kdepim, messagelib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27409
    P
    		gimp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26588
    P
    		libicu-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27079
    P
    		ant on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27321
    P
    		wpa_supplicant on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27964
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54485
    P
    		gpg2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55723
    P
    		Security update for supportutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25960
    P
    		Security update for gimp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26537
    P
    		dhcp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26645
    P
    		unrar on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27717
    P
    		Security update for CUPS
    2020-12-01
    oval:org.opensuse.security:def:27449
    P
    		libgnutls-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27978
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-01
    oval:org.opensuse.security:def:54507
    P
    		krb5-appl-clients on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55815
    P
    		Security update for libreoffice (Low)
    2020-12-01
    oval:org.opensuse.security:def:25961
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26590
    P
    		libmusicbrainz4 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26729
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27752
    P
    		Security update for gimp
    2020-12-01
    oval:org.opensuse.security:def:27531
    P
    		pango-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28022
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:54647
    P
    		pcsc-ccid on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26639
    P
    		star on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26303
    P
    		Security update for dnsmasq (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26880
    P
    		cyrus-imapd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27588
    P
    		xorg-x11-libXv-devel-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28660
    P
    		Security update for evolution-data-server
    2020-12-01
    oval:org.opensuse.security:def:54885
    P
    		libltdl7 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26678
    P
    		coolkey on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26304
    P
    		Security update for python-keystoneclient (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26933
    P
    		krb5-plugin-kdb-ldap on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27672
    P
    		Security update for Ruby on Rails
    2020-12-01
    oval:org.opensuse.security:def:28695
    P
    		Security update for gimp
    2020-12-01
    oval:org.opensuse.security:def:55058
    P
    		apparmor-docs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26692
    P
    		evince on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26315
    P
    		Security update for MozillaThunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26982
    P
    		libxslt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27245
    P
    		nagios on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27823
    P
    		Security update for libwmf (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55164
    P
    		libFLAC++6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57284
    P
    		Security update for xorg-x11-libXv
    2020-12-01
    oval:org.opensuse.security:def:26245
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26736
    P
    		libQtWebKit4-32bit on GA media (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:25494
    P
    		SUSE-SU-2014:0214-1 -- Security update for gimp
    2014-09-08
    oval:org.mitre.oval:def:21054
    P
    		USN-2051-1 -- gimp vulnerability
    2014-06-30
    oval:org.mitre.oval:def:20340
    P
    		DSA-2813-1 gimp - several
    2014-06-23
    oval:org.mitre.oval:def:23838
    P
    		ELSA-2013:1778: gimp security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:21262
    P
    		RHSA-2013:1778: gimp security update (Moderate)
    2014-02-17
    oval:org.opensuse.security:def:79992
    P
    		Security update for gimp
    2014-02-03
    oval:com.ubuntu.precise:def:20131978000
    V
    		CVE-2013-1978 on Ubuntu 12.04 LTS (precise) - medium.
    2013-12-12
    oval:com.redhat.rhsa:def:20131778
    P
    		RHSA-2013:1778: gimp security update (Moderate)
    2013-12-03
    BACK
    gimp gimp 2.8.10