Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gimp for openSUSE:Factory checked in at 2026-08-19 17:55:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gimp (Old) and /work/SRC/openSUSE:Factory/.gimp.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gimp" Wed Aug 19 17:55:33 2026 rev:170 rq:1371772 version:3.2.4 Changes: -------- --- /work/SRC/openSUSE:Factory/gimp/gimp.changes 2026-08-04 21:28:34.543936027 +0200 +++ /work/SRC/openSUSE:Factory/.gimp.new.1258/gimp.changes 2026-08-19 17:56:11.907428411 +0200 @@ -1,0 +2,9 @@ +Tue Aug 18 02:12:02 UTC 2026 - Alynx Zhou <[email protected]> + +- Add CVE fixes: + + gimp-CVE-2026-59087.patch (bsc#1274809, glgo#GNOME/gimp#16491) + + gimp-CVE-2026-59088.patch (bsc#1274837, glgo#GNOME/gimp#16492) + + gimp-CVE-2026-59090.patch (bsc#1274840, glgo#GNOME/gimp#16509) + + gimp-CVE-2026-59091.patch (bsc#1274851, glgo#GNOME/gimp#16510) + +------------------------------------------------------------------- New: ---- gimp-CVE-2026-59087.patch gimp-CVE-2026-59088.patch gimp-CVE-2026-59090.patch gimp-CVE-2026-59091.patch ----------(New B)---------- New:- Add CVE fixes: + gimp-CVE-2026-59087.patch (bsc#1274809, glgo#GNOME/gimp#16491) + gimp-CVE-2026-59088.patch (bsc#1274837, glgo#GNOME/gimp#16492) New: + gimp-CVE-2026-59087.patch (bsc#1274809, glgo#GNOME/gimp#16491) + gimp-CVE-2026-59088.patch (bsc#1274837, glgo#GNOME/gimp#16492) + gimp-CVE-2026-59090.patch (bsc#1274840, glgo#GNOME/gimp#16509) New: + gimp-CVE-2026-59088.patch (bsc#1274837, glgo#GNOME/gimp#16492) + gimp-CVE-2026-59090.patch (bsc#1274840, glgo#GNOME/gimp#16509) + gimp-CVE-2026-59091.patch (bsc#1274851, glgo#GNOME/gimp#16510) New: + gimp-CVE-2026-59090.patch (bsc#1274840, glgo#GNOME/gimp#16509) + gimp-CVE-2026-59091.patch (bsc#1274851, glgo#GNOME/gimp#16510) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gimp.spec ++++++ --- /var/tmp/diff_new_pack.4IzgXJ/_old 2026-08-19 17:56:13.914499714 +0200 +++ /var/tmp/diff_new_pack.4IzgXJ/_new 2026-08-19 17:56:13.916499785 +0200 @@ -109,6 +109,14 @@ Patch7: gimp-CVE-2026-66758.patch # PATCH-FIX-UPSTREAM gimp-CVE-2026-66759.patch bsc#1273153 [email protected] -- mitigate OOB write on ICNS mask data Patch8: gimp-CVE-2026-66759.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-59087.patch bsc#1274809, glgo#GNOME/gimp#16491 [email protected] -- Fix heap buffer overflow in `file-seattle-filmworks` load +Patch9: gimp-CVE-2026-59087.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-59088.patch bsc#1274837, glgo#GNOME/gimp#16492 [email protected] -- Fix denial of service via signed integer overflow in FLI file processing +Patch10: gimp-CVE-2026-59088.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-59090.patch bsc#1274840, glgo#GNOME/gimp#16509 [email protected] -- Fix arbitrary code execution in PSD plugin due to unsigned underflow +Patch11: gimp-CVE-2026-59090.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-59091.patch bsc#1274851, glgo#GNOME/gimp#16510 [email protected] -- Fix multiple vulnerabilities in file format plugins via crafted image file +Patch12: gimp-CVE-2026-59091.patch %if %{with debug_in_build_gimp} BuildRequires: gdb %endif ++++++ gimp-CVE-2026-59087.patch ++++++ >From bb36034bedb06305402ce836129efe8c8d4ad41d Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Thu, 18 Jun 2026 06:02:23 +0000 Subject: [PATCH] plug-ins: Mitigate #16491 Per the report, this fixes the memory allocation for Seattle Filmworks metadata to match the amount read into it. This patch also switches g_malloc () calls to g_try_malloc0 () and verifies we allocated sufficient memory. --- plug-ins/common/file-seattle-filmworks.c | 28 +++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/plug-ins/common/file-seattle-filmworks.c b/plug-ins/common/file-seattle-filmworks.c index e7d103568e2..4df174916b6 100644 --- a/plug-ins/common/file-seattle-filmworks.c +++ b/plug-ins/common/file-seattle-filmworks.c @@ -277,7 +277,15 @@ load_image (GFile *file, gboolean has_huffman_table = FALSE; if (data_size > 0) - data = g_malloc0 (data_size); + data = g_try_malloc0 (data_size); + + if (data == NULL) + { + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), + _("Invalid file.")); + fclose (fp); + return NULL; + } /* Load Camera Roll Number and Date metadata first */ if (fseek (fp, 0xE0, SEEK_SET) != 0 || @@ -312,16 +320,26 @@ load_image (GFile *file, /* Only load metadata if it is valid */ if (metadata_len[1]) { - roll_num = g_malloc (metadata_len[0] + 1); - photo_date = g_malloc (metadata_len[1] + 1); + roll_num = g_try_malloc0 (metadata_len[0] + 1); + photo_date = g_try_malloc0 ((index - metadata_len[1]) + 1); + + if (roll_num == NULL || photo_date == NULL) + { + g_set_error (error, G_FILE_ERROR, + g_file_error_from_errno (errno), + _("Invalid file.")); + fclose (fp); + g_free (data); + g_free (roll_num); + g_free (photo_date); + return NULL; + } fseek (fp, 0xE0, SEEK_SET); fread (roll_num, metadata_len[0], 1, fp); - roll_num[metadata_len[0]] = '\0'; fseek (fp, 0xE0 + metadata_len[1] + 1, SEEK_SET); fread (photo_date, index - metadata_len[1], 1, fp); - photo_date[metadata_len[1]] = '\0'; } fclose (fp); -- GitLab ++++++ gimp-CVE-2026-59088.patch ++++++ >From 1db4690bde3a349df046f85a4ee9a71af8492216 Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Tue, 16 Jun 2026 02:13:03 +0000 Subject: [PATCH] plug-ins: Mitigate issue #16492 Resolves #16492 Similar to 53cdb27f, we ensure that multiplying two gushorts in the FLI plug-in does not overflow by casting one of them to a larger datatype size. --- plug-ins/file-fli/fli-gimp.c | 26 ++++++++++++++++++++++---- plug-ins/file-fli/fli.c | 8 +++++--- 2 files changed, 27 insertions(+), 7 deletions(-) diff --git a/plug-ins/file-fli/fli-gimp.c b/plug-ins/file-fli/fli-gimp.c index b31c78d2c70..d2b876cc7d1 100644 --- a/plug-ins/file-fli/fli-gimp.c +++ b/plug-ins/file-fli/fli-gimp.c @@ -542,8 +542,17 @@ load_image (GFile *file, image = gimp_image_new (fli_header.width, fli_header.height, GIMP_INDEXED); - fb = g_malloc (fli_header.width * fli_header.height); - ofb = g_malloc (fli_header.width * fli_header.height); + fb = g_try_malloc ((gsize) fli_header.width * fli_header.height); + ofb = g_try_malloc ((gsize) fli_header.width * fli_header.height); + if (! fb || ! ofb) + { + g_set_error (error, G_FILE_ERROR, 0, + _("Memory could not be allocated.")); + fclose (fp); + g_free (fb); + g_free (ofb); + return FALSE; + } /* * Skip to the beginning of requested frames: @@ -802,8 +811,17 @@ export_image (GFile *file, } fseek (fp, 128, SEEK_SET); - fb = g_malloc (fli_header.width * fli_header.height); - ofb = g_malloc (fli_header.width * fli_header.height); + fb = g_try_malloc ((gsize) fli_header.width * fli_header.height); + ofb = g_try_malloc ((gsize) fli_header.width * fli_header.height); + if (! fb || ! ofb) + { + g_set_error (error, G_FILE_ERROR, 0, + _("Memory could not be allocated.")); + fclose (fp); + g_free (fb); + g_free (ofb); + return FALSE; + } /* initialize with bg color */ memset (fb, bg, fli_header.width * fli_header.height); diff --git a/plug-ins/file-fli/fli.c b/plug-ins/file-fli/fli.c index 1aba31e8f90..cffb487def7 100644 --- a/plug-ins/file-fli/fli.c +++ b/plug-ins/file-fli/fli.c @@ -883,7 +883,7 @@ fli_read_black (FILE *f, guchar *framebuf, GError **error) { - memset (framebuf, 0, fli_header->width * fli_header->height); + memset (framebuf, 0, (gsize) fli_header->width * fli_header->height); return TRUE; } @@ -1178,7 +1178,8 @@ fli_read_lc (FILE *f, gushort yc, firstline, numline; guchar *pos; - memcpy (framebuf, old_framebuf, fli_header->width * fli_header->height); + memcpy (framebuf, old_framebuf, + (gint64) fli_header->width * fli_header->height); if (! fli_read_short (f, &firstline, error) || ! fli_read_short (f, &numline, error)) @@ -1432,7 +1433,8 @@ fli_read_lc_2 (FILE *f, guchar *pos; guint32 len_read; - memcpy (framebuf, old_framebuf, fli_header->width * fli_header->height); + memcpy (framebuf, old_framebuf, + (gint64) fli_header->width * fli_header->height); yc = 0; if (! fli_read_short (f, &numline, error)) -- GitLab ++++++ gimp-CVE-2026-59090.patch ++++++ diff --unified --recursive --text --new-file --color gimp-3.2.4.old/plug-ins/file-psd/psd-load.c gimp-3.2.4.new/plug-ins/file-psd/psd-load.c --- gimp-3.2.4.old/plug-ins/file-psd/psd-load.c 2026-04-17 16:37:38.000000000 +0800 +++ gimp-3.2.4.new/plug-ins/file-psd/psd-load.c 2026-08-18 20:17:41.706272475 +0800 @@ -1052,6 +1052,16 @@ return NULL; } + if (block_len + 4 > block_rem) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Invalid block size.")); + /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ + g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) block_len); + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } + block_rem -= (block_len + 4); IFDBG(3) g_debug ("Offset: %" G_GOFFSET_FORMAT ", Remaining length %" G_GSIZE_FORMAT, PSD_TELL(input), (gsize) block_rem); @@ -1290,6 +1300,16 @@ return NULL; } + if (read_len > block_rem) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Invalid block size.")); + /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ + g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) read_len); + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } + block_rem -= read_len; IFDBG(3) g_debug ("Offset: %" G_GOFFSET_FORMAT ", Remaining length %" G_GSIZE_FORMAT, PSD_TELL(input), (gsize) block_rem); @@ -1310,6 +1330,15 @@ free_lyr_a (lyr_a, img_a->num_layers); return NULL; } + if (header_size > block_rem) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Invalid block size.")); + /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ + g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) header_size); + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } block_rem -= header_size; @@ -1338,6 +1367,16 @@ free_lyr_a (lyr_a, img_a->num_layers); return NULL; } + if (res_a.data_len > block_rem) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Invalid block size.")); + /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ + g_debug ("Invalid block size: %" G_GSIZE_FORMAT, res_a.data_len); + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } + block_rem -= res_a.data_len; IFDBG(3) g_debug ("Remaining length in block: %" G_GSIZE_FORMAT, (gsize) block_rem); } ++++++ gimp-CVE-2026-59091.patch ++++++ >From eb91d3b793fbe0766520a3510d9396fbbed916f7 Mon Sep 17 00:00:00 2001 From: Alx Sa <[email protected]> Date: Mon, 22 Jun 2026 21:21:29 +0000 Subject: [PATCH] plug-ins: Mitigate #16510 Per security reporter Feng Xue, we should add checks to ensure the index for the compressed data iterator does not exceed the size of the compressed data itself. --- plug-ins/common/file-paa.c | 57 ++++++++++++++++++++++++++------------ 1 file changed, 40 insertions(+), 17 deletions(-) diff --git a/plug-ins/common/file-paa.c b/plug-ins/common/file-paa.c index 53ee7dab636..d52965351cc 100644 --- a/plug-ins/common/file-paa.c +++ b/plug-ins/common/file-paa.c @@ -93,6 +93,7 @@ static GimpImage * load_image (GFile *fi static gboolean read_tag (FILE *fp, GError **error); static gboolean decode_lzss (guchar *raw_data, + guint32 raw_data_size, guchar *uncompressed_data, gint estimated_size); @@ -298,14 +299,20 @@ load_image (GFile *file, ((guint32) block_size_array[1] << 8) + block_size_array[0]; - raw_data = g_malloc0 (block_size); + raw_data = g_try_malloc0 (block_size); + if (raw_data == NULL) + { + g_set_error (error, G_FILE_ERROR, 0, + _("Memory could not be allocated.")); + return image; + } + if (fread (raw_data, block_size, 1, fp) == 0) { g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, _("Couldn't read image data from '%s'"), gimp_file_get_utf8_name (file)); - - return NULL; + return image; } if (image == NULL) @@ -355,7 +362,8 @@ load_image (GFile *file, return NULL; } - if (! decode_lzss (raw_data, uncompressed_data, estimated_size)) + if (! decode_lzss (raw_data, block_size, uncompressed_data, + estimated_size)) { g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, _("Couldn't decompress image data from '%s'"), @@ -476,9 +484,10 @@ read_tag (FILE *fp, * https://github.com/PackJC/Paint.NET-PAA-PAC-Importer/ blob/main/BIS/Core/Compression/LZSS.cs */ static gboolean -decode_lzss (guchar *raw_data, - guchar *uncompressed_data, - gint estimated_size) +decode_lzss (guchar *raw_data, + guint32 raw_data_size, + guchar *uncompressed_data, + gint estimated_size) { gchar char_array[4113]; gint index = 4078; @@ -486,7 +495,7 @@ decode_lzss (guchar *raw_data, gint raw_index = 0; gint data_index = 0; - if (estimated_size <= 0) + if (raw_data_size <= 0 || estimated_size <= 0) return FALSE; for (gint i = 0; i < index; i++) @@ -494,13 +503,20 @@ decode_lzss (guchar *raw_data, while (estimated_size > 0) { + if (raw_index > raw_data_size - 1) + return FALSE; + if (((flag >>= 1) & 256) == 0) - flag = raw_data[raw_index++] | 65280; + flag = raw_data[raw_index++] | 65280; if ((flag & 1) != 0) { - guchar value = raw_data[raw_index++]; + guchar value; + + if (raw_index > raw_data_size - 1) + return FALSE; + value = raw_data[raw_index++]; uncompressed_data[data_index++] = value; estimated_size--; @@ -510,15 +526,22 @@ decode_lzss (guchar *raw_data, } else { - gint b1 = raw_data[raw_index++]; - gint b2 = raw_data[raw_index++]; - gint b3 = b1 | (b2 & 0xF0) << 4; - gint b4 = (b2 & 0x0F) + 2; + gint b[4]; + gint offset; + gint end_offset; + + if (raw_index > raw_data_size - 2) + return FALSE; + + b[0] = raw_data[raw_index++]; + b[1] = raw_data[raw_index++]; + b[2] = b[0] | (b[1] & 0xF0) << 4; + b[3] = (b[1] & 0x0F) + 2; - gint offset = index - b3; - gint end_offset = b4 + offset; + offset = index - b[2]; + end_offset = b[3] + offset; - if ((b4 + 1) > (guint32) estimated_size) + if ((b[3] + 1) > (guint32) estimated_size) return FALSE; for (; offset <= end_offset; offset++) -- GitLab
