CVE-2023-44443
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious PSP image files in GIMP. An integer overflow during PSP file parsing enables memory corruption that can lead to remote code execution. All GIMP users who open untrusted PSP files are affected.
💻 Affected Systems
- GIMP (GNU Image Manipulation Program)
📦 What is this software?
Gimp by Gimp
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the GIMP user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or malware installation on the user's system when opening a malicious PSP file.
If Mitigated
No impact if users only open trusted files or have patched versions.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability is in a widely used image processing library.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: GIMP 2.10.36 and later
Vendor Advisory: https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/
Restart Required: Yes
Instructions:
1. Download GIMP 2.10.36 or later from official sources. 2. Install the update following your OS package manager instructions. 3. Restart GIMP to ensure the patch is active.
🔧 Temporary Workarounds
Disable PSP file support
linuxRemove or disable PSP file format plugin to prevent parsing of malicious files
mv /usr/lib/gimp/2.0/plug-ins/file-psp /usr/lib/gimp/2.0/plug-ins/file-psp.disabled
Restart GIMP
Use file type restrictions
allConfigure system to block or warn about PSP file execution
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized GIMP instances
- Educate users to never open PSP files from untrusted sources and use alternative image viewers for PSP files
🔍 How to Verify
Check if Vulnerable:
Check GIMP version: if below 2.10.36, system is vulnerableCheck Version:
gimp --version | head -1Verify Fix Applied:
Verify GIMP version is 2.10.36 or higher and attempt to open a known safe PSP file📡 Detection & Monitoring
Log Indicators:
- GIMP crash logs with memory access violations
- Unexpected process spawning from GIMP
Network Indicators:
- Outbound connections from GIMP process to unknown IPs
- Unexpected DNS queries from GIMP
SIEM Query:
process_name:"gimp" AND (event_type:crash OR parent_process:unexpected)