CVE-2018-12713 Race condition in n/a

Critical 9.1 Published 24 Jun 2018 Updated 5 Aug 2024

Attackers can exploit a race condition in GIMP's temporary file handling to overwrite files or read private content.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-12713?

CVE-2018-12713 is a critical vulnerability in Gimp Gimp, published on 24 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was intended to be private.

Which versions are affected by CVE-2018-12713?

It affects 1 product.

Products include Gimp Gimp.

How do I fix CVE-2018-12713?

Upgrade to a fixed version.

Is CVE-2018-12713 being exploited?

There is no known exploitation of CVE-2018-12713 in the wild and no public exploit code.

All Gimp Gimp vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-12713, GHSA-hcxp-87ww-ww9m, UBUNTU-CVE-2018-12713.