
Catalogo CVE
CVE-2023-44442
gimp affected and fixed versions
GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Was ZDI-CAN-22094.
- Gravità
- High · CVSS 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 61.17% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debiantrixie-security | gimp | 3.0.4-3+deb13u11 | Fixed | [CVE-2023-44442] |
| Debiantrixie | gimp | 2.10.36-1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debiantrixie | gimp | 3.0.4-3+deb13u10 | Fixed | [CVE-2023-44442] |
| Debiansid | gimp | 2.10.36-1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debiansid | gimp | 3.2.6-1 | Fixed | [CVE-2023-44442] |
| Debianforky | gimp | 2.10.36-1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debianforky | gimp | 3.2.6-1 | Fixed | [CVE-2023-44442] |
| Debianbookworm-security | gimp | 2.10.34-1+deb12u10 | Fixed | [CVE-2023-44442] |
| Debianbookworm | gimp | 2.10.34-1+deb12u1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debianbookworm | gimp | 2.10.34-1+deb12u10 | Fixed | [CVE-2023-44442] |
Showing 10 fix observations. All 32 observations, including unknown and conflicting reports, are available below.
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | gimp | 2.10.34-1+deb12u1 | UnknownSource applicability is not established | Provider not reported |
| Debianbookworm | gimp | 2.10.34-1+deb12u1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debianbookworm | gimp | 2.10.34-1+deb12u10 | Fixed | [CVE-2023-44442] |
| Debianbookworm-security | gimp | 2.10.34-1+deb12u10 | Fixed | [CVE-2023-44442] |
| Debianforky | gimp | 2.10.36-1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debianforky | gimp | 3.2.6-1 | Fixed | [CVE-2023-44442] |
| Debiansid | gimp | 2.10.36-1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debiansid | gimp | 3.2.6-1 | Fixed | [CVE-2023-44442] |
| Debiantrixie | gimp | 2.10.36-1 | FixedDistribution-reported fixed boundary | [CVE-2023-44442] |
| Debiantrixie | gimp | 3.0.4-3+deb13u10 | Fixed | [CVE-2023-44442] |
| Debiantrixie-security | gimp | 3.0.4-3+deb13u11 | Fixed | [CVE-2023-44442] |
| Suselinux enterprise software development kit 12 sp5 | gimp | 2.8.18-9.27.1 | UnknownSource applicability is not established | [SUSE-SU-2023:4697-1] |
| Suselinux enterprise workstation extension 12 sp5 | gimp | 2.8.18-9.27.1 | UnknownSource applicability is not established | [SUSE-SU-2023:4697-1] |
| Ubuntu20.04 | gimp | 2.10.14-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu20.04 | gimp | 2.10.14-2build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu20.04 | gimp | 2.10.14-2ubuntu1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu20.04 | gimp | 2.10.14-3 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu20.04 | gimp | 2.10.18-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu20.04 | gimp | 2.10.18-1ubuntu0.1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu20.04 | gimp | 2.10.8-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu22.04 | gimp | 2.10.24-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu22.04 | gimp | 2.10.28-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu22.04 | gimp | 2.10.30-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu22.04 | gimp | 2.10.30-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntu22.04 | gimp | 2.10.30-1ubuntu0.1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.20-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.20-1.1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.20-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.22-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.22-1ubuntu0.1~esm1 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.22-1ubuntu0.1~esm2 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
| Ubuntupro | gimp | 2.8.22-1ubuntu0.1~esm3 | UnknownSource applicability is not established | [UBUNTU-CVE-2023-44442] |
Original provider fields
{
"package_releases": [
{
"name": "gimp",
"status": "fixed",
"release": "sid",
"version": "3.2.6-1"
},
{
"name": "gimp",
"status": "fixed",
"release": "forky",
"version": "3.2.6-1"
},
{
"name": "gimp",
"status": "fixed",
"release": "trixie",
"version": "3.0.4-3+deb13u10"
},
{
"name": "gimp",
"status": "fixed",
"release": "trixie-security",
"version": "3.0.4-3+deb13u11"
},
{
"name": "gimp",
"status": "fixed",
"release": "bookworm",
"version": "2.10.34-1+deb12u10"
},
{
"name": "gimp",
"status": "fixed",
"release": "bookworm-security",
"version": "2.10.34-1+deb12u10"
}
],
"fixed_versions": [
{
"bug": 1055984,
"name": "gimp",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "2.10.36-1"
},
{
"bug": 1055984,
"name": "gimp",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "2.10.36-1"
},
{
"bug": 1055984,
"name": "gimp",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "2.10.36-1"
},
{
"bug": 1055984,
"name": "gimp",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "2.10.34-1+deb12u1"
}
],
"distribution_packages": [
{
"name": "gimp",
"fixed_version": "2.10.34-1+deb12u1",
"applicability_unknown": true
},
{
"name": "gimp",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "pro",
"versions": [
"2.8.20-1",
"2.8.20-1.1",
"2.8.20-2",
"2.8.22-1",
"2.8.22-1ubuntu0.1~esm1",
"2.8.22-1ubuntu0.1~esm2",
"2.8.22-1ubuntu0.1~esm3"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2023-44442",
"provider_updated_at": "2026-04-22T14:12:56.139391Z",
"applicability_unknown": true
},
{
"name": "gimp",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.18-1ubuntu0.1"
}
]
}
],
"release": "20.04",
"versions": [
"2.10.8-2",
"2.10.14-2",
"2.10.14-2build1",
"2.10.14-2ubuntu1",
"2.10.14-3",
"2.10.18-1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442",
"fixed_version": "2.10.18-1ubuntu0.1",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2023-44442",
"provider_updated_at": "2026-04-22T14:12:56.139391Z",
"applicability_unknown": true
},
{
"name": "gimp",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.30-1ubuntu0.1"
}
]
}
],
"release": "22.04",
"versions": [
"2.10.24-2",
"2.10.28-1",
"2.10.30-1",
"2.10.30-1build1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442",
"fixed_version": "2.10.30-1ubuntu0.1",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2023-44442",
"provider_updated_at": "2026-04-22T14:12:56.139391Z",
"applicability_unknown": true
},
{
"name": "gimp",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.18-9.27.1"
}
]
}
],
"release": "linux enterprise software development kit 12 sp5",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:4697-1",
"fixed_version": "2.8.18-9.27.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2023:4697-1",
"provider_updated_at": "2026-02-04T03:43:19.897240Z",
"applicability_unknown": true
},
{
"name": "gimp",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.18-9.27.1"
}
]
}
],
"release": "linux enterprise workstation extension 12 sp5",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2023:4697-1",
"fixed_version": "2.8.18-9.27.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2023:4697-1",
"provider_updated_at": "2026-02-04T03:43:19.897240Z",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
L’associazione dei pacchetti è in corso.
[Debian 12 (Bookworm)]
- [gimp]Sconosciuto
Dettagli (4)
2.10.34-1+deb12u10· amd64 · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· arm64 · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· amd64 · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· arm64 · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
- [gimp-data]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (4)
2.10.34-1+deb12u10· all · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· all · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· all · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· all · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
- [libgimp2.0]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (4)
2.10.34-1+deb12u10· amd64 · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· arm64 · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· amd64 · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· arm64 · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
- [libgimp2.0-dev]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (4)
2.10.34-1+deb12u10· amd64 · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· arm64 · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· amd64 · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· arm64 · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
- [libgimp2.0-doc]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (4)
2.10.34-1+deb12u10· all · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· all · bookwormCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· all · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
2.10.34-1+deb12u10· all · bookworm-securityCorretta · Corretta:
2.10.34-1+deb12u1dsa · gimp · debian · bookworm; dsa · gimp · debian · 12
[Debian 13 (Trixie)]
- [gimp]Sconosciuto
Dettagli (6)
3.0.4-3+deb13u9· amd64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· arm64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· arm64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· amd64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
- [gimp-data]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (6)
3.0.4-3+deb13u9· all · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· all · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· all · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· all · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· all · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· all · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
- [gir1.2-gimp-3.0]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (6)
3.0.4-3+deb13u9· amd64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· arm64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· arm64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· amd64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
- [libgimp-3.0-0]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (6)
3.0.4-3+deb13u9· amd64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· arm64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· arm64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· amd64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
- [libgimp-3.0-bin]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (6)
3.0.4-3+deb13u9· amd64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· arm64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· arm64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· amd64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
- [libgimp-3.0-dev]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (6)
3.0.4-3+deb13u9· amd64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· arm64 · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· arm64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· amd64 · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· amd64 · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
- [libgimp-3.0-doc]Sconosciuto
Pacchetto sorgente: [gimp]
Dettagli (6)
3.0.4-3+deb13u9· all · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u9· all · trixieCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· all · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u10· all · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u11· all · trixie-securityCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
3.0.4-3+deb13u8· all · trixie-security · Historical versionCorretta · Corretta:
2.10.36-1dsa · gimp · debian · 13
Osservato:
Riferimenti
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_4692-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-44442]
- [https://osv.dev/vulnerability/SUSE-SU-2023:4697-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-44442]
- [https://security-tracker.debian.org/tracker/CVE-2023-44442]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-44442.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2933.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]