CVE-2017-17787
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common...
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
CVE-2017-17787- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
CVE-2017-17787- Updated
- 2026-11-02
EUVDEUVD-2017-8938 No score
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
EUVD-2017-8938- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gh65-7qg5-gfmr
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common...
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
GHSA-gh65-7qg5-gfmr- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
CVE-2017-17787- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-17787
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
DEBIAN-CVE-2017-17787- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2017-17787
In GIMP 2.8.22, there is a heap-based buffer over-read in read_creator_block in plug-ins/common/file-psp.c.
- Record
UBUNTU-CVE-2017-17787- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0030 No score
Updated gimp packages fix security vulnerability
Several vulnerabilities were discovered in the GIMP which could result in denial of service (application crash) or potentially the execution of arbitrary code if malformed files are opened (CVE-2017-17784, CVE-2017-17785, CVE-2017-17786, CVE-2017-17787, CVE-2017-17788, CVE-2017-17789).
- Record
MGASA-2018-0030- Updated
- 2026-11-02
OSVMGASA-2018-0273 No score
Updated gimp packages fix security vulnerabilities
Updated gimp packages fix security vulnerabilities:
Several vulnerabilities were discovered in GIMP which could result in denial of service (application crash) or potentially the execution of arbitrary code if malformed files are opened (CVE-2017-17784, CVE-2017-17785, CVE-2017-17786, CVE-2017-17787, CVE-2017-17788, CVE-2017-17789).
Also, the webkit1-based help browser plugin has been disabled in favor of using an external browser for the help pages. This is due to security issues in webkit.
- Record
MGASA-2018-0273- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:2357-1 No score
Security update for gimp
This update for gimp fixes the following issues:
Security issue fixed:
- CVE-2017-17787: Fixed an out-of-bounds read in the PSP importer (bsc#1073628).
Non-security issue fixed:
- Fixed a software crash while importing a PostScript file (bsc#1178726).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:2357-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3940-1 No score
Security update for gimp
This update for gimp fixes the following issues:
Security issue fixed:
- CVE-2017-17787: Fixed an out-of-bounds read in the PSP importer (bsc#1073628).
Non-security issue fixed:
- Fixed a software crash while importing a PostScript file (bsc#1178726).
- Record
SUSE-SU-2020:3940-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3944-1 No score
Security update for gimp
This update for gimp fixes the following issue:
- CVE-2017-17787: Fixed an out-of-bounds read in the PSP importer (bsc#1073628).
- Record
SUSE-SU-2020:3944-1- Updated
- 2026-11-02
OSVUSN-3539-1 No score
gimp vulnerabilities
It was discovered that GIMP incorrectly handled certain images. If a user were tricked into opening a specially crafted image, an attacker could possibly use this to execute arbitrary code. (CVE-2017-17784, CVE-2017-17785, CVE-2017-17786, CVE-2017-17787, CVE-2017-17788, CVE-2017-17789)
- Record
USN-3539-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:12 |
before 2.8.20-1.1 | 2.8.20-1.1 |
gimpDebian:13 |
before 2.8.20-1.1 | 2.8.20-1.1 |
gimpDebian:14 |
before 2.8.20-1.1 | 2.8.20-1.1 |
gimpDebian:7 From an advisory covering 6 CVEs |
before 2.8.2-2+deb7u3, plus listed versions 2.8.2-22.8.2-2+deb7u12.8.2-2+deb7u2 |
2.8.2-2+deb7u3 |
gimpDebian:8 From an advisory covering 6 CVEs |
before 2.8.14-1+deb8u2, plus listed versions 2.8.14-12.8.14-1+deb8u1 |
2.8.14-1+deb8u2 |
gimpDebian:9 From an advisory covering 6 CVEs |
before 2.8.18-1+deb9u1, plus listed versions 2.8.18-1 |
2.8.18-1+deb9u1 |
gimpMageia:5 From an advisory covering 6 CVEs |
before 2.8.14-4.3.mga5 | 2.8.14-4.3.mga5 |
gimpMageia:6 From an advisory covering 6 CVEs |
before 2.8.22-1.2.mga6 | 2.8.22-1.2.mga6 |
gimpSUSE:Linux Enterprise Workstation Extension 15 SP1 |
before 2.8.22-5.8.1 | 2.8.22-5.8.1 |
gimpSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.8.18-9.15.2 | 2.8.18-9.15.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gimpSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 2.8.18-9.15.2 | 2.8.18-9.15.2 |
gimpUbuntu:14.04:LTS |
before 2.8.10-0ubuntu1.2, plus listed versions 2.8.6-1ubuntu12.8.6-1ubuntu22.8.6-1ubuntu32.8.10-0ubuntu12.8.10-0ubuntu1.1 |
2.8.10-0ubuntu1.2 |
gimpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.8.14-1ubuntu22.8.14-1.2ubuntu12.8.16-1ubuntu12.8.16-1ubuntu1.12.8.16-1ubuntu1.1+esm12.8.16-1ubuntu1.1+esm22.8.16-1ubuntu1.1+esm3 |
None known |
gimpUbuntu:14.04:LTS From an advisory covering 6 CVEs |
before 2.8.10-0ubuntu1.2, plus listed versions 2.8.6-1ubuntu12.8.6-1ubuntu22.8.6-1ubuntu32.8.10-0ubuntu12.8.10-0ubuntu1.1 |
2.8.10-0ubuntu1.2 |
gimpopenSUSE:Leap 15.1 |
before 2.8.22-lp151.5.6.1 | 2.8.22-lp151.5.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-17787 is a high vulnerability (CVSS 7.8) in Gimp, published December 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in gimp 2.8.20-1.1.
References
debian.org/security/2017/dsa-4077
usn.ubuntu.com/3539-1
openwall.com/lists/oss-security/2017/12/19/5
lists.debian.org/debian-lts-announce/2017/12/msg00023.html
bugzilla.gnome.org/show_bug.cgi?id=790853
nvd.nist.gov/vuln/detail/CVE-2017-17787
Show 23 moreShow less
github.com/advisories/GHSA-gh65-7qg5-gfmr
security-tracker.debian.org/tracker/CVE-2017-17787
advisories.mageia.org/MGASA-2018-0030.html
bugs.mageia.org/show_bug.cgi?id=22291
lists.opensuse.org/opensuse-updates/2018-01/msg00014.html
suse.com/support/update/announcement/2020/suse-su-20203940-1
bugzilla.suse.com/1073628
ubuntu.com/security/CVE-2017-17787
git.gnome.org/browse/GIMP/commit?id=eb2980683e6472aff35a3117587c4f814515c74d
cve.org/CVERecord?id=CVE-2017-17787