Catalogo CVE

CVE-2023-44442

gimp affected and fixed versions

[Catalogo CVE]

GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.

Gravità
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
61.17% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securitygimp3.0.4-3+deb13u11Fixed[CVE-2023-44442]
Debiantrixiegimp2.10.36-1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debiantrixiegimp3.0.4-3+deb13u10Fixed[CVE-2023-44442]
Debiansidgimp2.10.36-1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debiansidgimp3.2.6-1Fixed[CVE-2023-44442]
Debianforkygimp2.10.36-1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debianforkygimp3.2.6-1Fixed[CVE-2023-44442]
Debianbookworm-securitygimp2.10.34-1+deb12u10Fixed[CVE-2023-44442]
Debianbookwormgimp2.10.34-1+deb12u1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debianbookwormgimp2.10.34-1+deb12u10Fixed[CVE-2023-44442]

Showing 10 fix observations. All 32 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedgimp2.10.34-1+deb12u1UnknownSource applicability is not establishedProvider not reported
Debianbookwormgimp2.10.34-1+deb12u1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debianbookwormgimp2.10.34-1+deb12u10Fixed[CVE-2023-44442]
Debianbookworm-securitygimp2.10.34-1+deb12u10Fixed[CVE-2023-44442]
Debianforkygimp2.10.36-1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debianforkygimp3.2.6-1Fixed[CVE-2023-44442]
Debiansidgimp2.10.36-1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debiansidgimp3.2.6-1Fixed[CVE-2023-44442]
Debiantrixiegimp2.10.36-1FixedDistribution-reported fixed boundary[CVE-2023-44442]
Debiantrixiegimp3.0.4-3+deb13u10Fixed[CVE-2023-44442]
Debiantrixie-securitygimp3.0.4-3+deb13u11Fixed[CVE-2023-44442]
Suselinux enterprise software development kit 12 sp5gimp2.8.18-9.27.1UnknownSource applicability is not established[SUSE-SU-2023:4697-1]
Suselinux enterprise workstation extension 12 sp5gimp2.8.18-9.27.1UnknownSource applicability is not established[SUSE-SU-2023:4697-1]
Ubuntu20.04gimp2.10.14-2UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu20.04gimp2.10.14-2build1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu20.04gimp2.10.14-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu20.04gimp2.10.14-3UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu20.04gimp2.10.18-1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu20.04gimp2.10.18-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu20.04gimp2.10.8-2UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu22.04gimp2.10.24-2UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu22.04gimp2.10.28-1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu22.04gimp2.10.30-1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu22.04gimp2.10.30-1build1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntu22.04gimp2.10.30-1ubuntu0.1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.20-1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.20-1.1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.20-2UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.22-1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.22-1ubuntu0.1~esm1UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.22-1ubuntu0.1~esm2UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Ubuntuprogimp2.8.22-1ubuntu0.1~esm3UnknownSource applicability is not established[UBUNTU-CVE-2023-44442]
Original provider fields
{
  "package_releases": [
    {
      "name": "gimp",
      "status": "fixed",
      "release": "sid",
      "version": "3.2.6-1"
    },
    {
      "name": "gimp",
      "status": "fixed",
      "release": "forky",
      "version": "3.2.6-1"
    },
    {
      "name": "gimp",
      "status": "fixed",
      "release": "trixie",
      "version": "3.0.4-3+deb13u10"
    },
    {
      "name": "gimp",
      "status": "fixed",
      "release": "trixie-security",
      "version": "3.0.4-3+deb13u11"
    },
    {
      "name": "gimp",
      "status": "fixed",
      "release": "bookworm",
      "version": "2.10.34-1+deb12u10"
    },
    {
      "name": "gimp",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "2.10.34-1+deb12u10"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1055984,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.10.36-1"
    },
    {
      "bug": 1055984,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.10.36-1"
    },
    {
      "bug": 1055984,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.10.36-1"
    },
    {
      "bug": 1055984,
      "name": "gimp",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.10.34-1+deb12u1"
    }
  ],
  "distribution_packages": [
    {
      "name": "gimp",
      "fixed_version": "2.10.34-1+deb12u1",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.8.20-1",
        "2.8.20-1.1",
        "2.8.20-2",
        "2.8.22-1",
        "2.8.22-1ubuntu0.1~esm1",
        "2.8.22-1ubuntu0.1~esm2",
        "2.8.22-1ubuntu0.1~esm3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-44442",
      "provider_updated_at": "2026-04-22T14:12:56.139391Z",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.18-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "2.10.8-2",
        "2.10.14-2",
        "2.10.14-2build1",
        "2.10.14-2ubuntu1",
        "2.10.14-3",
        "2.10.18-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442",
      "fixed_version": "2.10.18-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-44442",
      "provider_updated_at": "2026-04-22T14:12:56.139391Z",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.10.30-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2.10.24-2",
        "2.10.28-1",
        "2.10.30-1",
        "2.10.30-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442",
      "fixed_version": "2.10.30-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2023-44442",
      "provider_updated_at": "2026-04-22T14:12:56.139391Z",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.18-9.27.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:4697-1",
      "fixed_version": "2.8.18-9.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:4697-1",
      "provider_updated_at": "2026-02-04T03:43:19.897240Z",
      "applicability_unknown": true
    },
    {
      "name": "gimp",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.18-9.27.1"
            }
          ]
        }
      ],
      "release": "linux enterprise workstation extension 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:4697-1",
      "fixed_version": "2.8.18-9.27.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2023:4697-1",
      "provider_updated_at": "2026-02-04T03:43:19.897240Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1055984]

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

  • [gimp]Sconosciuto
    Dettagli (4)
    • 2.10.34-1+deb12u10 · amd64 · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · arm64 · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · amd64 · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · arm64 · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

  • [gimp-data]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (4)
    • 2.10.34-1+deb12u10 · all · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · all · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · all · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · all · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

  • [libgimp2.0]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (4)
    • 2.10.34-1+deb12u10 · amd64 · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · arm64 · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · amd64 · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · arm64 · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

  • [libgimp2.0-dev]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (4)
    • 2.10.34-1+deb12u10 · amd64 · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · arm64 · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · amd64 · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · arm64 · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

  • [libgimp2.0-doc]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (4)
    • 2.10.34-1+deb12u10 · all · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · all · bookworm

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · all · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

    • 2.10.34-1+deb12u10 · all · bookworm-security

      Corretta · Corretta: 2.10.34-1+deb12u1

      dsa · gimp · debian · bookworm; dsa · gimp · debian · 12

[Debian 13 (Trixie)]

  • [gimp]Sconosciuto
    Dettagli (6)
    • 3.0.4-3+deb13u9 · amd64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · arm64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · arm64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · amd64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

  • [gimp-data]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (6)
    • 3.0.4-3+deb13u9 · all · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · all · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · all · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · all · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · all · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · all · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

  • [gir1.2-gimp-3.0]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (6)
    • 3.0.4-3+deb13u9 · amd64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · arm64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · arm64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · amd64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

  • [libgimp-3.0-0]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (6)
    • 3.0.4-3+deb13u9 · amd64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · arm64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · arm64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · amd64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

  • [libgimp-3.0-bin]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (6)
    • 3.0.4-3+deb13u9 · amd64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · arm64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · arm64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · amd64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

  • [libgimp-3.0-dev]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (6)
    • 3.0.4-3+deb13u9 · amd64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · arm64 · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · arm64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · amd64 · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · amd64 · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

  • [libgimp-3.0-doc]Sconosciuto

    Pacchetto sorgente: [gimp]

    Dettagli (6)
    • 3.0.4-3+deb13u9 · all · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u9 · all · trixie

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · all · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u10 · all · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u11 · all · trixie-security

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

    • 3.0.4-3+deb13u8 · all · trixie-security · Historical version

      Corretta · Corretta: 2.10.36-1

      dsa · gimp · debian · 13

Osservato:

Riferimenti