Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gimp for openSUSE:Factory checked in at 2026-08-04 21:27:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gimp (Old) and /work/SRC/openSUSE:Factory/.gimp.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gimp" Tue Aug 4 21:27:53 2026 rev:169 rq:1369174 version:3.2.4 Changes: -------- --- /work/SRC/openSUSE:Factory/gimp/gimp.changes 2026-07-14 13:46:28.375904939 +0200 +++ /work/SRC/openSUSE:Factory/.gimp.new.16738/gimp.changes 2026-08-04 21:28:34.543936027 +0200 @@ -1,0 +2,8 @@ +Fri Jul 31 21:40:35 UTC 2026 - Michael Gorse <[email protected]> + +- Add CVE fixes: + + gimp-CVE-2026-66757.patch (bsc#1273151 CVE-2026-66757) + + gimp-CVE-2026-66758.patch (bsc#1273152 CVE-2026-66758) + + gimp-CVE-2026-66759.patch (bsc#1273153 CVE-2026-66759) + +------------------------------------------------------------------- New: ---- gimp-CVE-2026-66757.patch gimp-CVE-2026-66758.patch gimp-CVE-2026-66759.patch ----------(New B)---------- New:- Add CVE fixes: + gimp-CVE-2026-66757.patch (bsc#1273151 CVE-2026-66757) + gimp-CVE-2026-66758.patch (bsc#1273152 CVE-2026-66758) New: + gimp-CVE-2026-66757.patch (bsc#1273151 CVE-2026-66757) + gimp-CVE-2026-66758.patch (bsc#1273152 CVE-2026-66758) + gimp-CVE-2026-66759.patch (bsc#1273153 CVE-2026-66759) New: + gimp-CVE-2026-66758.patch (bsc#1273152 CVE-2026-66758) + gimp-CVE-2026-66759.patch (bsc#1273153 CVE-2026-66759) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gimp.spec ++++++ --- /var/tmp/diff_new_pack.UVtQyo/_old 2026-08-04 21:28:35.911983373 +0200 +++ /var/tmp/diff_new_pack.UVtQyo/_new 2026-08-04 21:28:35.911983373 +0200 @@ -103,6 +103,12 @@ Patch3: gimp-2.99.19-no-phone-home-default.patch Patch4: gimp-CVE-2026-58379.patch Patch5: gimp-CVE-2026-59089.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-66757.patch bsc#1273151 [email protected] -- fix a signed integer overflow processing SGI images. +Patch6: gimp-CVE-2026-66757.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-66758.patch bsc#1273152 [email protected] -- mitigate overflow in FITS import. +Patch7: gimp-CVE-2026-66758.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-66759.patch bsc#1273153 [email protected] -- mitigate OOB write on ICNS mask data +Patch8: gimp-CVE-2026-66759.patch %if %{with debug_in_build_gimp} BuildRequires: gdb %endif ++++++ gimp-CVE-2026-66757.patch ++++++ >From adb89f0f2c086240fc49f6e2c946d89e10b66a70 Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Tue, 16 Jun 2026 09:21:37 +0000 Subject: [PATCH] plug-ins: Mitigate issue #16494 Resolves #16494 Similar to 53cdb27f, we ensure that multiplying two gushorts in the SGI plug-in does not overflow by casting one of them to a larger datatype size. We also switch from calloc () to g_try_malloc () to better handle out-of-memory allocation problems. --- plug-ins/file-sgi/sgi-lib.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) Index: gimp-3.2.4/plug-ins/file-sgi/sgi-lib.c =================================================================== --- gimp-3.2.4.orig/plug-ins/file-sgi/sgi-lib.c +++ gimp-3.2.4/plug-ins/file-sgi/sgi-lib.c @@ -338,7 +338,7 @@ sgiOpenFile(FILE *file, /* I - File to o free(sgip); return (NULL); } - sgip->table[0] = calloc(sgip->ysize * sgip->zsize, sizeof(long)); + sgip->table[0] = g_try_malloc ((gsize) sgip->ysize * sgip->zsize * 4); if (sgip->table[0] == NULL) { free(sgip->table); @@ -438,7 +438,8 @@ sgiOpenFile(FILE *file, /* I - File to o free(sgip); return (NULL); } - sgip->table[0] = calloc(sgip->ysize * sgip->zsize, sizeof(long)); + sgip->table[0] = + g_try_malloc ((gsize) sgip->ysize * sgip->zsize * 4); if (sgip->table[0] == NULL) { free(sgip->table); @@ -449,7 +450,8 @@ sgiOpenFile(FILE *file, /* I - File to o for (i = 1; i < sgip->zsize; i ++) sgip->table[i] = sgip->table[0] + i * sgip->ysize; sgip->length = calloc(sgip->zsize, sizeof(long *)); - sgip->length[0] = calloc(sgip->ysize * sgip->zsize, sizeof(long)); + sgip->length[0] = + g_try_malloc ((gsize) sgip->ysize * sgip->zsize * 4); for (i = 1; i < sgip->zsize; i ++) sgip->length[i] = sgip->length[0] + i * sgip->ysize; break; ++++++ gimp-CVE-2026-66758.patch ++++++ >From 89ae907fea5ccc8bd1f626dbe01fdcfe29940ac9 Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Sun, 28 Jun 2026 12:58:47 +0000 Subject: [PATCH] plug-ins: Mitigate overflow in FITS import When allocating memory for importing FITS, it was possible for the operation to overflow the largest datatype size, guint32. This patch adds a cast to gsize for this operation, to reduce the risk of exceeding the space limit before attempting to allocate. (cherry picked from commit b01d06315352b56928625e480dd22b3876721e2c) --- plug-ins/file-fits/fits.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c index 938d54e4eb..4394a3f3b8 100644 --- a/plug-ins/file-fits/fits.c +++ b/plug-ins/file-fits/fits.c @@ -490,11 +490,11 @@ load_image (GFile *file, /* If RGB FITS image, we need to read in the whole image so we can * convert the planes format to RGB */ if (hdu.naxis == 2) - pixels = - (gdouble *) g_try_malloc (width * sizeof (gdouble) * channels); + pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) * + channels); else - pixels = - (gdouble *) g_try_malloc (width * height * sizeof (gdouble) * channels); + pixels = (gdouble *) g_try_malloc ((gsize) width * height * + sizeof (gdouble) * channels); if (pixels == NULL) { -- 2.55.0 ++++++ gimp-CVE-2026-66759.patch ++++++ >From abb3129a8ecb79bf3af6df03bc35ddf8f7aaba20 Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Tue, 7 Jul 2026 15:54:40 +0000 Subject: [PATCH] plug-ins: Mitigate OOB write on ICNS mask data As reported by Tristan, it is possible to create an ICNS icon with mask data smaller than the icon size. In this case, our current code could potentially go out of bounds when writing from file. This patch adds a check to stop executing the code if we reach the end of the mask data in the file. --- plug-ins/file-icns/file-icns-load.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c index f1709e1074..82f7ad0292 100644 --- a/plug-ins/file-icns/file-icns-load.c +++ b/plug-ins/file-icns/file-icns-load.c @@ -398,7 +398,7 @@ icns_decompress (guchar *dest, { if (out >= max) { - g_message ("Corrupt icon? compressed run overflows output size."); + g_message ("Corrupt icon: compressed run overflows output size."); return FALSE; } dest[out++ * 4 + channel] = val; @@ -444,10 +444,19 @@ icns_decompress (guchar *dest, else if (mask) { gchar typestring[5]; - fourcc_get_string (mask->type, typestring); + fourcc_get_string (mask->type, typestring); for (out = 0; out < max; out++) - dest[out * 4 + 3] = mask->data[mask->cursor++]; + { + if (mask->cursor >= mask->size) + { + g_message ("Corrupt icon mask: uncompressed run overflows input " + "size."); + return FALSE; + } + + dest[out * 4 + 3] = mask->data[mask->cursor++]; + } } return TRUE; } -- 2.55.0
