Launchpad.net

CVE 2012-4245

The scriptfu network server in GIMP 2.6 does not require authentication, which allows remote attackers to execute arbitrary commands via the python-fu-eval command.

See the CVE page on Mitre.org for more details.