Bb1Abu

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw in the PSD parser allows an integer overflow in the `read RLE channel()` function. This overflow can lead to an undersized heap allocation for the RLE row-length table, causing subsequent per-row writes to corrupt heap memory. Such memory corruption may result in a denial of service or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw exists in the PNM file format parser where the `pnmscanner gettoken()` function contains an off-by-one error in its loop boundary check. When processing a specially crafted PNM file, the function writes a null terminator one byte beyond the end of a stack-allocated buffer. This out-of-bounds write causes memory corruption of adjacent stack memory, which can lead to a denial of service (DoS) via a crash or potentially allow arbitrary code execution in the context of the user opening the file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GIMP (affected versions not specified) **Description** A flaw exists in the PSP file format parser. A double-free condition, which occurs when a program attempts to free the same memory location twice, happens in the `read layer block()` function when processing a specially crafted PSP file. This can lead to memory corruption, potentially resulting in a denial of service or arbitrary code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.