CVE-2016-4994

HIGH7.8EPSS 0.64%

gimp - security update

Published: 7/12/2016Modified: 3/9/2026

Also known as:DSA-3612-1DEBIAN-CVE-2016-4994

Description

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.

Affected packages (3)

Debian/gimpfrom 0, < 2.8.16-2.2
Debian/gimpfrom 0, < 2.8.2-2+deb7u2
Debian/gimpfrom 0, < 2.8.14-1+deb8u1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-4994