Mageia alert MGASA-2018-0273 (gimp)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2018-0273: Updated gimp packages fix security vulnerabilities 
Date:
    	     
 
Wed, 6 Jun 2018 20:16:22 +0200
Message-ID:
    	     
 
<20180606181622.874589FEF7@duvel.mageia.org>
MGASA-2018-0273 - Updated gimp packages fix security vulnerabilities

Publication date: 06 Jun 2018
URL: https://advisories.mageia.org/MGASA-2018-0273.html
Type: security
Affected Mageia releases: 6
CVE: CVE-2017-17784,
     CVE-2017-17785,
     CVE-2017-17786,
     CVE-2017-17787,
     CVE-2017-17788,
     CVE-2017-17789

Description:
Updated gimp packages fix security vulnerabilities:

Several vulnerabilities were discovered in GIMP which could result in denial of
service (application crash) or potentially the execution of arbitrary code if
malformed files are opened (CVE-2017-17784, CVE-2017-17785, CVE-2017-17786,
CVE-2017-17787, CVE-2017-17788, CVE-2017-17789).

Also, the webkit1-based help browser plugin has been disabled in favor of using
an external browser for the help pages.  This is due to security issues in
webkit.

References:
- https://bugs.mageia.org/show_bug.cgi?id=22252
- https://www.debian.org/security/2017/dsa-4077
- https://lists.opensuse.org/opensuse-updates/2018-01/msg00...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1...

SRPMS:
- 6/core/gimp-2.8.22-1.2.mga6