[Solved] GIMP - 2.10.4 - Possible False Positive

[Zian]

https://www.gimp.org/downloads/ says that the current stable release is "2.10.4" but CARMA shows the application as "Unsafe" while indicating that the installed version is "2.10.4".

[Tom]

Hi Zian,
Thanks for reporting this.
This is a known issue, if you read this post:
https://vulndetect.org/post/1310

However, GIMP seems to be vulnerable to this old vuln:
CVE-2017-17789 in file-psp.exe
There is no immediate announcements or entries in the changelog about this being fixed.

As soon as we get some pointer to a changelog or other statement about this being fixed in a specific version, then we will update the rules to reflect this.

[OLLI_S]

@Zian There are two suggestions in this forum related to such issues:

• Show Reason for Unsafe Status
• New Status "Outdated" (for non-security updates)

Feel free to comment and vote on those suggestions.

[Tom]

We found evidence that this is indeed fixed, state has been updated to reflect this

[OLLI_S]

So is this issue fixed now?

[Tom]

@OLLI_S
Yes

[OLLI_S]

Then I mark it as solved.