CVE-2009-0723: gimp Integer Overflow or Wraparound

Modified

Published 23-03-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-0723 is a high (CVSS 9.3) Integer Overflow or Wraparound vulnerability in gimp. EPSS estimates a 5.03% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

5.03%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 4

DSA-1745-1 DSA-1769-1 RHSA-2009:0339 RHSA-2009:0377

Timeline

23-03-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple integer overflows in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allow context-dependent attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

5.03%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.03% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (scary.beasts.org)
Maturity: unknown
referenceUnverified
Exploit Reference (scarybeastsecurity.blogspot.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Gimp1 product

gimp< 2.9.2

Littlecms1 product

little_cms≤ 1.17

Mozilla1 product

firefox3.1:beta1

Sun1 product

openjdk≤ 7

4 vendors · 4 products

References

41 links

www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:137Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/34632Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34450Third Party AdvisoryX Refsource SECUNIABroken Link
www.securitytracker.com/id?1021869VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.ubuntu.com/usn/USN-744-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.debian.org/security/2009/dsa-1745Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/34675Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 41 references

secunia.com/advisories/34454Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34442Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
scary.beasts.org/security/CESA-2009-003.htmlX Refsource MISCExploit
secunia.com/advisories/34382Third Party AdvisoryX Refsource SECUNIABroken Link
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438Vendor AdvisoryX Refsource SLACKWAREThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/49326VDB EntryX Refsource XFThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=487508X Refsource CONFIRMIssue TrackingThird Party Advisory
secunia.com/advisories/34418Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/archive/1/502031/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
rhn.redhat.com/errata/RHSA-2009-0377.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.ocert.org/advisories/ocert-2009-003.htmlX Refsource MISCThird Party Advisory
scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.htmlX Refsource MISCExploit
secunia.com/advisories/34782Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34367Third Party AdvisoryX Refsource SECUNIABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:162Vendor AdvisoryX Refsource MANDRIVABroken Link
www.redhat.com/support/errata/RHSA-2009-0339.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.vupen.com/english/advisories/2009/0775VDB EntryX Refsource VUPENBroken Link
secunia.com/advisories/34463Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/34408Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2009/dsa-1769Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/34400Third Party AdvisoryX Refsource SECUNIABroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11780VDB EntrySignatureX Refsource OVALTool Signature
www.mandriva.com/security/advisories?name=MDVSA-2009:121Vendor AdvisoryX Refsource MANDRIVABroken Link
www.securityfocus.com/archive/1/502018/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.securityfocus.com/bid/34185VDB EntryX Refsource BIDBroken LinkPatchThird Party Advisory
security.gentoo.org/glsa/glsa-200904-19.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory