CVE-2016-4994

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-updates/2016-07/msg00005.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2589.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3612Third Party Advisory
http://www.securityfocus.com/bid/91425Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036226Third Party Advisory, VDB Entry
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.431987Third Party Advisory
http://www.ubuntu.com/usn/USN-3025-1Third Party Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=767873Issue Tracking, Third Party Advisory
https://git.gnome.org/browse/gimp/commit/?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6fIssue Tracking, Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2016-07/msg00005.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2589.htmlThird Party Advisory
http://www.debian.org/security/2016/dsa-3612Third Party Advisory
http://www.securityfocus.com/bid/91425Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036226Third Party Advisory, VDB Entry
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.431987Third Party Advisory
http://www.ubuntu.com/usn/USN-3025-1Third Party Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=767873Issue Tracking, Third Party Advisory
https://git.gnome.org/browse/gimp/commit/?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6fIssue Tracking, Patch, Vendor Advisory

Timeline

Published: Jul 12, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-49955.3Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote auth CVE-2016-49967.0discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in t CVE-2016-49977.8The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 CVE-2016-49987.1The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a den CVE-2016-49999.8SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in CVE-2016-50005.5The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an CVE-2016-50015.5This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of H CVE-2016-50027.8XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attack CVE-2016-50039.8The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted CVE-2016-50046.5The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (CVE-2016-50054.8Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary CVE-2016-50069.8The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive