SUSE-SU-2017:3062-1 Security update for gimp
Disabling unmaintained WebKit1 support in GIMP prevents exploitation of known vulnerabilities in the embedded browser component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is SUSE-SU-2017:3062-1?
SUSE-SU-2017:3062-1 is a vulnerability in gimp, published on 23 Nov 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
This update for gimp fixes the following issues:
Don't build gimp with webkit1 support, as it is no longer maintained and has plenty of security bugs.
This disables the GIMP's built-in help browser; it will use an external browser when configured this way.
This works around a number of security vulnerabilities in Webkit1.
Which versions are affected by SUSE-SU-2017:3062-1?
Linux distribution packages (6)
gimp SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 2.8.18-9.3.26 |
gimp SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 2.8.18-9.3.26 |
gimp SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 2.8.18-9.3.26 |
gimp SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 2.8.18-9.3.26 |
gimp SUSE:Linux Enterprise Workstation Extension 12 SP2 | All versions | 2.8.18-9.3.26 |
gimp SUSE:Linux Enterprise Workstation Extension 12 SP3 | All versions | 2.8.18-9.3.26 |
How do I fix SUSE-SU-2017:3062-1?
Apply the vendor's patch.
Is SUSE-SU-2017:3062-1 being exploited?
There is no known exploitation of SUSE-SU-2017:3062-1 in the wild and no public exploit code.