Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2022-30067: GIMP can crash or exhaust memory with crafted XCF
CVE-2022-30067 · published 4 years ago
Summary
The image editor GIMP (versions 2.10.30 and 2.99.10) can run out of memory or stop working when it opens a specially made XCF file. This happens because the program tries to reserve an unusually large amount of memory. To stay safe, avoid opening XCF files from unknown sources and apply any updates released by your Linux distribution.
What to do
- Update canonical gimp to version 2.10.18-1ubuntu0.1.
- Update canonical gimp to version 2.10.30-1ubuntu0.1.
- Update debian gimp to version 2.10.22-4+deb11u5.
- Update debian gimp to version 2.10.32-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | gimp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | gimp | All versions |
| Ubuntu:20.04:LTS | canonical | gimp |
< 2.10.18-1ubuntu0.1 Fix: upgrade to 2.10.18-1ubuntu0.1
|
| Ubuntu:22.04:LTS | canonical | gimp |
< 2.10.30-1ubuntu0.1 Fix: upgrade to 2.10.30-1ubuntu0.1
|
| Debian:11 | debian | gimp |
< 2.10.22-4+deb11u5 Fix: upgrade to 2.10.22-4+deb11u5
|
| Debian:12 | debian | gimp |
< 2.10.32-1 Fix: upgrade to 2.10.32-1
|
| Debian:13 | debian | gimp |
< 2.10.32-1 Fix: upgrade to 2.10.32-1
|
| – | gimp | gimp |
2.10.30 2.99.10 cpe:2.3:a:gimp:gimp:2.10.30:*:*:*:*:*:*:* |
Original advisory text
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.
GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash.
References
- https://ubuntu.com/security/CVE-2022-30067 Third Party Advisory
- https://ubuntu.com/security/notices/USN-6521-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-30067 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30067... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-30067 Vendor Advisory
- https://gitlab.gnome.org/GNOME/gimp/-/issues/8120 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-30067 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00015.html Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-120Classic Buffer Overflow
Timeline
Published17 May 2022
Updated4 Nov 2026
First seen13 Mar 2026
Sources
UBUNTU-CVE-2022-30067 · OSV
DEBIAN-CVE-2022-30067 · OSV
CVE-2022-30067 · OSV
CVE-2022-30067 · NVD
Track software like this
Free during beta