attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
Red Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, and Red Hat Enterprise Linux 6
Classified as
CWE-131 (Incorrect Calculation of Buffer Size)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Enterprise Linux
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 7
Red Hat
Red Hat Enterprise Linux 6
Subsystems
OT Supporting Infrastructure
Sectors
All Sectors
What to Know
A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases. See vendor advisory link below.