CVE-2009-0581: gimp

Modified

Published 23-03-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-0581 is a medium (CVSS 4.3) vulnerability in gimp. EPSS estimates a 2.50% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

2.50%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 4

DSA-1745-1 DSA-1769-1 RHSA-2009:0339 RHSA-2009:0377

Timeline

23-03-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

2.50%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

No change 0.00 pp

From 2.50% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (scary.beasts.org)
Maturity: unknown
referenceUnverified
Exploit Reference (scarybeastsecurity.blogspot.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Gimp1 product

gimp< 2.9.2

Littlecms1 product

little_cms≤ 1.17

Mozilla1 product

firefox3.1:beta1

Oracle1 product

openjdk≤ 7

4 vendors · 4 products

References

41 links

www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:137Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/34632Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34450Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.ubuntu.com/usn/USN-744-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.debian.org/security/2009/dsa-1745Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/34675Third Party AdvisoryX Refsource SECUNIABroken Link
exchange.xforce.ibmcloud.com/vulnerabilities/49328VDB EntryX Refsource XFThird Party Advisory

Show all 41 references

secunia.com/advisories/34454Third Party AdvisoryX Refsource SECUNIABroken Link
www.securitytracker.com/id?1021870VDB EntryX Refsource SECTRACKThird Party Advisory
secunia.com/advisories/34442Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
scary.beasts.org/security/CESA-2009-003.htmlX Refsource MISCExploit
secunia.com/advisories/34382Third Party AdvisoryX Refsource SECUNIABroken Link
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438Vendor AdvisoryX Refsource SLACKWAREThird Party Advisory
secunia.com/advisories/34418Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/archive/1/502031/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
rhn.redhat.com/errata/RHSA-2009-0377.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.ocert.org/advisories/ocert-2009-003.htmlX Refsource MISCThird Party Advisory
scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.htmlX Refsource MISCExploit
secunia.com/advisories/34782Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34367Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:162Vendor AdvisoryX Refsource MANDRIVABroken Link
www.redhat.com/support/errata/RHSA-2009-0339.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.vupen.com/english/advisories/2009/0775VDB EntryX Refsource VUPENPatchVendor Advisory
secunia.com/advisories/34463Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34408Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2009/dsa-1769Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/34400Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:121Vendor AdvisoryX Refsource MANDRIVABroken Link
www.securityfocus.com/archive/1/502018/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
bugzilla.redhat.com/show_bug.cgi?id=487509X Refsource CONFIRMIssue Tracking
www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10023VDB EntrySignatureX Refsource OVALTool Signature
www.securityfocus.com/bid/34185VDB EntryX Refsource BIDPatchThird Party Advisory
security.gentoo.org/glsa/glsa-200904-19.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory