{"id":"CVE-2007-3126","aliases":["DEBIAN-CVE-2007-3126","EUVD-2007-3118","GHSA-4vhr-6jhx-vf2q","MGASA-2017-0112","SUSE-SU-2017:0945-1","openSUSE-SU-2024:10785-1"],"status":"published","title":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an...","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02852,"percentile":0.8681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2007-06-08T00:00:00Z","modified":"2026-10-21T17:47:33Z","fixes":[{"ecosystem":"Debian:12","package":"gimp","fixed_in":["2.8.22-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gimp","fixed_in":["2.8.22-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gimp","fixed_in":["2.8.22-1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"gimp","fixed_in":["2.8.14-4.2.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"gimp","fixed_in":["2.8.18-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"gimp","fixed_in":["2.8.18-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"gimp","fixed_in":["2.8.18-8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.22-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.22-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.22-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.14-4.2.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18-8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gimp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.24-3.1"}]}],"bundled":4}],"products":[{"vendor":"gimp","product":"gimp"}],"references":[{"url":"http://osvdb.org/43453","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link","web"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=778604","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://git.gnome.org/browse/gimp/commit/?id=323ecb73f7bf36788fb7066eb2d6678830cd5de7","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/archive/1/470751/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/34789","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.gimp.org/news/2017/05/11/gimp-2-8-22-released/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3126"},{"url":"https://www.gimp.org/news/2017/05/11/gimp-2-8-22-released"},{"url":"https://github.com/advisories/GHSA-4vhr-6jhx-vf2q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-3126","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0112.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20663","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-04/msg00046.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170945-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1025717","tags":["report"]},{"url":"https://bugzilla.suse.com/1032241","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3126","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2949","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2007-3126","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","status":"published","published":"2007-06-08T00:00:00Z","modified":"2024-08-07T14:05:28.411Z","updated_at":"2026-11-02T13:32:45.563938Z"}],"euvd":[{"id":"EUVD-2007-3118","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","status":"published","published":"2007-06-08T00:00:00Z","modified":"2024-08-07T14:05:28Z","updated_at":"2026-11-03T01:38:18.026387Z"}],"ghsa":[{"id":"GHSA-4vhr-6jhx-vf2q","title":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an...","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","status":"published","published":"2022-05-01T18:10:40Z","modified":"2025-04-09T03:42:30Z","updated_at":"2026-11-02T15:00:53.859901Z"}],"nvd":[{"id":"CVE-2007-3126","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","status":"published","published":"2007-06-08T00:30:00Z","modified":"2026-06-16T22:41:07.337Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:16.479378Z"}],"osv":[{"id":"CVE-2007-3126","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","status":"published","published":"2007-06-08T00:30:00Z","modified":"2026-04-16T06:21:18.527958568Z","updated_at":"2026-11-02T15:43:56.865964Z"},{"id":"DEBIAN-CVE-2007-3126","description":"Gimp before 2.8.22 allows context-dependent attackers to cause a denial of service (crash) via an ICO file with an InfoHeader containing a Height of zero, a similar issue to CVE-2007-2237.","status":"published","published":"2007-06-08T00:30:00Z","modified":"2026-10-21T17:47:33.808830778Z","updated_at":"2026-11-02T15:45:23.411908Z"},{"id":"MGASA-2017-0112","title":"Updated gimp packages fix security vulnerability","description":"Context-dependent attackers were able to cause a denial of service via an\nICO file with an InfoHeader containing a Height of zero (CVE-2007-3126).\n","status":"published","published":"2017-04-21T07:24:22Z","modified":"2026-04-16T06:24:09.001344088Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:10785-1","title":"gimp-2.10.24-3.1 on GA media","description":"These are all security issues fixed in the gimp-2.10.24-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:38.809588Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:0945-1","title":"Security update for gimp","description":"\nThis update for gimp fixes the following issues:\n\nThis security issue was fixed:\n\n- CVE-2007-3126: Context-dependent attackers were able to cause a denial of service via an ICO file with an InfoHeader containing a Height of zero (bsc#1032241).\n\nThese non-security issues were fixed:\n\n- bsc#1025717: Prefer lcms2 over lcms1 if both are available\n- bgo#593576: Preven crash in PDF Import filter when importing large image PDF or specifying high resolution \n","status":"published","published":"2017-04-05T15:25:39Z","modified":"2026-02-04T04:03:28.370868Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}