From 8a8cfef6d692d45739297ea52c61ba0b255d20f35eb5c9f6333d05e041091788 Mon Sep 17 00:00:00 2001 From: Michael Vetter Date: Sat, 17 Jan 2026 08:10:50 +0000 Subject: [PATCH] - Add CVE fixes: + gimp-CVE-2025-14422.patch (bsc#1255293 CVE-2025-14422) + gimp-CVE-2025-14423.patch (bsc#1255294 CVE-2025-14423) + gimp-CVE-2025-14424.patch (bsc#1255295 CVE-2025-14424) + gimp-CVE-2025-14425.patch (bsc#1255296 CVE-2025-14425) OBS-URL: https://build.opensuse.org/package/show/graphics/gimp?expand=0&rev=100 --- .gitattributes | 23 + .gitignore | 1 + ...cm-system-monitor-profile-by-default.patch | 25 + gimp-2.99.19-external-help-browser.patch | 13 + gimp-2.99.19-no-phone-home-default.patch | 12 + gimp-3.0.4.tar.xz | 3 + gimp-3.0.6.tar.xz | 3 + gimp-CVE-2025-10920.patch | 36 + gimp-CVE-2025-10922.patch | 147 + gimp-CVE-2025-10924.patch | 91 + gimp-CVE-2025-10925.patch | 46 + gimp-CVE-2025-14422.patch | 63 + gimp-CVE-2025-14423.patch | 103 + gimp-CVE-2025-14424.patch | 31 + gimp-CVE-2025-14425.patch | 69 + gimp-CVE-2025-15059.patch | 38 + gimp.changes | 3816 +++++++++++++++++ gimp.spec | 543 +++ macros.gimp | 5 + openSUSE.gpl | 19 + 20 files changed, 5087 insertions(+) create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 gimp-2.99.19-cm-system-monitor-profile-by-default.patch create mode 100644 gimp-2.99.19-external-help-browser.patch create mode 100644 gimp-2.99.19-no-phone-home-default.patch create mode 100644 gimp-3.0.4.tar.xz create mode 100644 gimp-3.0.6.tar.xz create mode 100644 gimp-CVE-2025-10920.patch create mode 100644 gimp-CVE-2025-10922.patch create mode 100644 gimp-CVE-2025-10924.patch create mode 100644 gimp-CVE-2025-10925.patch create mode 100644 gimp-CVE-2025-14422.patch create mode 100644 gimp-CVE-2025-14423.patch create mode 100644 gimp-CVE-2025-14424.patch create mode 100644 gimp-CVE-2025-14425.patch create mode 100644 gimp-CVE-2025-15059.patch create mode 100644 gimp.changes create mode 100644 gimp.spec create mode 100644 macros.gimp create mode 100644 openSUSE.gpl diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9b03811 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,23 @@ +## Default LFS +*.7z filter=lfs diff=lfs merge=lfs -text +*.bsp filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.gem filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.jar filter=lfs diff=lfs merge=lfs -text +*.lz filter=lfs diff=lfs merge=lfs -text +*.lzma filter=lfs diff=lfs merge=lfs -text +*.obscpio filter=lfs diff=lfs merge=lfs -text +*.oxt filter=lfs diff=lfs merge=lfs -text +*.pdf filter=lfs diff=lfs merge=lfs -text +*.png filter=lfs diff=lfs merge=lfs -text +*.rpm filter=lfs diff=lfs merge=lfs -text +*.tbz filter=lfs diff=lfs merge=lfs -text +*.tbz2 filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.ttf filter=lfs diff=lfs merge=lfs -text +*.txz filter=lfs diff=lfs merge=lfs -text +*.whl filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..57affb6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.osc diff --git a/gimp-2.99.19-cm-system-monitor-profile-by-default.patch b/gimp-2.99.19-cm-system-monitor-profile-by-default.patch new file mode 100644 index 0000000..0c64d01 --- /dev/null +++ b/gimp-2.99.19-cm-system-monitor-profile-by-default.patch @@ -0,0 +1,25 @@ +diff -up gimp-2.99.18/etc/gimprc.in.cm-system-monitor-profile-by-default gimp-2.99.18/etc/gimprc.in +--- gimp-2.99.18/etc/gimprc.in.cm-system-monitor-profile-by-default 2024-02-17 18:01:20.000000000 +0100 ++++ gimp-2.99.18/etc/gimprc.in 2024-05-07 14:39:06.468575598 +0200 +@@ -316,9 +316,9 @@ + + # Defines the color management behavior. This is a parameter list. + # +-# (color-management ++(color-management + # (mode display) +-# (display-profile-from-gdk no) ++ (display-profile-from-gdk no) + # (display-rendering-intent relative-colorimetric) + # (display-use-black-point-compensation yes) + # (display-optimize yes) +@@ -326,7 +326,8 @@ + # (simulation-use-black-point-compensation no) + # (simulation-optimize yes) + # (simulation-gamut-check no) +-# (out-of-gamut-color (color-rgb 1 0 1))) ++# (out-of-gamut-color (color-rgb 1 0 1)) ++) + + # Keep a permanent record of all opened and saved files in the Recent + # Documents list. Possible values are yes and no. diff --git a/gimp-2.99.19-external-help-browser.patch b/gimp-2.99.19-external-help-browser.patch new file mode 100644 index 0000000..be5601d --- /dev/null +++ b/gimp-2.99.19-external-help-browser.patch @@ -0,0 +1,13 @@ +Index: gimp-3.0.4/etc/gimprc.in +=================================================================== +--- gimp-3.0.4.orig/etc/gimprc.in ++++ gimp-3.0.4/etc/gimprc.in +@@ -823,7 +823,7 @@ + # Sets the browser used by the help system. Possible values are gimp and + # web-browser. + # +-# (help-browser gimp) ++(help-browser web-browser) + + # The maximum number of actions saved in history. This is an integer value. + # diff --git a/gimp-2.99.19-no-phone-home-default.patch b/gimp-2.99.19-no-phone-home-default.patch new file mode 100644 index 0000000..2e0629a --- /dev/null +++ b/gimp-2.99.19-no-phone-home-default.patch @@ -0,0 +1,12 @@ +diff -up gimp-2.99.18/etc/gimprc.in.no-phone-home-default gimp-2.99.18/etc/gimprc.in +--- gimp-2.99.18/etc/gimprc.in.no-phone-home-default 2024-05-07 14:40:02.746185394 +0200 ++++ gimp-2.99.18/etc/gimprc.in 2024-05-07 14:40:49.353862228 +0200 +@@ -399,7 +399,7 @@ + # Check for availability of GIMP updates through background internet queries. + # Possible values are yes and no. + # +-# (check-updates yes) ++(check-updates no) + + # Timestamp of the last update check. This is an integer value. + # diff --git a/gimp-3.0.4.tar.xz b/gimp-3.0.4.tar.xz new file mode 100644 index 0000000..5a29031 --- /dev/null +++ b/gimp-3.0.4.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:8caa2ec275bf09326575654ac276afc083f8491e7cca45d19cf29e696aecab25 +size 27060240 diff --git a/gimp-3.0.6.tar.xz b/gimp-3.0.6.tar.xz new file mode 100644 index 0000000..bfe7669 --- /dev/null +++ b/gimp-3.0.6.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:246c225383c72ef9f0dc7703b7d707084bbf177bd2900e94ce466a62862e296b +size 27197880 diff --git a/gimp-CVE-2025-10920.patch b/gimp-CVE-2025-10920.patch new file mode 100644 index 0000000..6f74719 --- /dev/null +++ b/gimp-CVE-2025-10920.patch @@ -0,0 +1,36 @@ +From 5f4329d324b0db7a857918941ef7e1d27f3d3992 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 3 Sep 2025 13:41:10 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-27684 + +Prevent overflow attack by checking if +output >= max, not just output > max. +--- + plug-ins/file-icns/file-icns-load.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c +index c8f16fef60..f2298c056e 100644 +--- a/plug-ins/file-icns/file-icns-load.c ++++ b/plug-ins/file-icns/file-icns-load.c +@@ -323,7 +323,7 @@ icns_decompress (guchar *dest, + + for (run -= 125; run > 0; run--) + { +- if (out > max) ++ if (out >= max) + { + g_message ("Corrupt icon? compressed run overflows output size."); + return FALSE; +@@ -341,7 +341,7 @@ icns_decompress (guchar *dest, + g_message ("Corrupt icon: uncompressed run overflows input size."); + return FALSE; + } +- if (out > max) ++ if (out >= max) + { + g_message ("Corrupt icon: uncompressed run overflows output size."); + return FALSE; +-- +2.49.0 + diff --git a/gimp-CVE-2025-10922.patch b/gimp-CVE-2025-10922.patch new file mode 100644 index 0000000..87e57c6 --- /dev/null +++ b/gimp-CVE-2025-10922.patch @@ -0,0 +1,147 @@ +From 3d909166463731e94dfe62042d76225ecfc4c1e4 Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Wed, 3 Sep 2025 13:31:45 -0400 +Subject: [PATCH] plug-ins: fix dicom plug-in ZDI-CAN-27863 + +GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution +Vulnerability + +This adds more safety checks and sets actual GError's instead of just +calling gimp_quit. + +Closes #14811 + +(cherry picked from commit 0f309f9a8d82f43fa01383bc5a5c41d28727d9e3) +--- + plug-ins/common/file-dicom.c | 65 ++++++++++++++++++++++++++++-------- + 1 file changed, 51 insertions(+), 14 deletions(-) + +diff --git a/plug-ins/common/file-dicom.c b/plug-ins/common/file-dicom.c +index 31039050f2..a11a13ef40 100644 +--- a/plug-ins/common/file-dicom.c ++++ b/plug-ins/common/file-dicom.c +@@ -344,6 +344,7 @@ load_image (GFile *file, + gint bits_stored = 0; + gint high_bit = 0; + guint8 *pix_buf = NULL; ++ guint64 pixbuf_size = 0; + gboolean is_signed = FALSE; + guint8 in_sequence = 0; + gboolean implicit_encoding = FALSE; +@@ -399,6 +400,7 @@ load_image (GFile *file, + guint16 ctx_us; + guint8 *value; + guint32 tag; ++ size_t actual_read; + + if (fread (&group_word, 1, 2, dicom) == 0) + break; +@@ -503,15 +505,24 @@ load_image (GFile *file, + + if (element_length >= (G_MAXUINT - 6)) + { +- g_message ("'%s' seems to have an incorrect value field length.", +- gimp_file_get_utf8_name (file)); +- gimp_quit (); ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("'%s' has an an incorrect value for field size. Possibly corrupt image."), ++ gimp_file_get_utf8_name (file)); ++ g_free (dicominfo); ++ fclose (dicom); ++ return NULL; + } + + /* Read contents. Allocate a bit more to make room for casts to int + below. */ + value = g_new0 (guint8, element_length + 4); +- fread (value, 1, element_length, dicom); ++ actual_read = fread (value, 1, element_length, dicom); ++ if (actual_read < element_length) ++ { ++ g_warning ("Missing data: needed %u bytes, got %u. Possibly corrupt image.", ++ element_length, (guint32) actual_read); ++ element_length = actual_read; ++ } + + /* ignore everything inside of a sequence */ + if (in_sequence) +@@ -524,7 +535,7 @@ load_image (GFile *file, + if (big_endian && group_word != 0x0002) + ctx_us = GUINT16_SWAP_LE_BE (ctx_us); + +- g_debug ("group: %04x, element: %04x, length: %d", ++ g_debug ("group: %04x, element: %04x, length: %u", + group_word, element_word, element_length); + g_debug ("Value: %s", (char*)value); + /* Recognize some critical tags */ +@@ -658,6 +669,7 @@ load_image (GFile *file, + if (group_word == 0x7fe0 && element_word == 0x0010) + { + pix_buf = value; ++ pixbuf_size = element_length; + } + else + { +@@ -688,25 +700,50 @@ load_image (GFile *file, + } + } + ++ g_debug ("Bpp: %d, wxh: %u x %u, spp: %d\n", bpp, width, height, samples_per_pixel); ++ + if ((bpp != 8) && (bpp != 16)) + { +- g_message ("'%s' has a bpp of %d which GIMP cannot handle.", +- gimp_file_get_utf8_name (file), bpp); +- gimp_quit (); ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("'%s' has a bpp of %d which GIMP cannot handle."), ++ gimp_file_get_utf8_name (file), bpp); ++ g_free (pix_buf); ++ g_free (dicominfo); ++ fclose (dicom); ++ return NULL; + } + + if ((width > GIMP_MAX_IMAGE_SIZE) || (height > GIMP_MAX_IMAGE_SIZE)) + { +- g_message ("'%s' has a larger image size (%d x %d) than GIMP can handle.", +- gimp_file_get_utf8_name (file), width, height); +- gimp_quit (); ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("'%s' has a larger image size (%d x %d) than GIMP can handle."), ++ gimp_file_get_utf8_name (file), width, height); ++ g_free (pix_buf); ++ g_free (dicominfo); ++ fclose (dicom); ++ return NULL; + } + + if (samples_per_pixel > 3) + { +- g_message ("'%s' has samples per pixel of %d which GIMP cannot handle.", +- gimp_file_get_utf8_name (file), samples_per_pixel); +- gimp_quit (); ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("'%s' has samples per pixel of %d which GIMP cannot handle."), ++ gimp_file_get_utf8_name (file), samples_per_pixel); ++ g_free (pix_buf); ++ g_free (dicominfo); ++ fclose (dicom); ++ return NULL; ++ } ++ ++ if ((guint64) width * height * (bpp >> 3) * samples_per_pixel > pixbuf_size) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("'%s' has not enough pixel data. Possibly corrupt image."), ++ gimp_file_get_utf8_name (file)); ++ g_free (pix_buf); ++ g_free (dicominfo); ++ fclose (dicom); ++ return NULL; + } + + dicominfo->width = width; +-- +2.49.0 + diff --git a/gimp-CVE-2025-10924.patch b/gimp-CVE-2025-10924.patch new file mode 100644 index 0000000..c55f071 --- /dev/null +++ b/gimp-CVE-2025-10924.patch @@ -0,0 +1,91 @@ +From 53b18653bca9404efeab953e75960b1cf7dedbed Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 3 Sep 2025 22:10:34 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-27836 + +ZDI-CAN-27836: GIMP FF File Parsing Integer Overflow +Remote Code Execution Vulnerability + +This patch increases the row_size data type to gsize and checks if it +would overflow based on the width given. It also makes sure the image +size does not exceed GIMP's image size limits. +--- + plug-ins/common/file-farbfeld.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +diff --git a/plug-ins/common/file-farbfeld.c b/plug-ins/common/file-farbfeld.c +index f610fa439a..921e4e35cc 100644 +--- a/plug-ins/common/file-farbfeld.c ++++ b/plug-ins/common/file-farbfeld.c +@@ -261,7 +261,7 @@ load_image (GFile *file, + guchar magic_number[8]; + guint32 width; + guint32 height; +- guint32 row_size; ++ gsize row_size; + const Babl *format = babl_format ("R'G'B'A u16"); + FILE *fp; + +@@ -282,13 +282,24 @@ load_image (GFile *file, + { + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), + _("Failed to read Farbfeld header")); ++ fclose (fp); + return NULL; + } + + /* Header information is stored in Big-Endian format */ + width = GUINT32_FROM_BE (width); + height = GUINT32_FROM_BE (height); +- row_size = width * sizeof (guint16) * 4; ++ ++ if (width > GIMP_MAX_IMAGE_SIZE || ++ height > GIMP_MAX_IMAGE_SIZE || ++ ! g_size_checked_mul (&row_size, width, (sizeof (guint16) * 4))) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("Image dimensions too large: width %d x height %d"), ++ width, height); ++ fclose (fp); ++ return NULL; ++ } + + image = gimp_image_new_with_precision (width, height, GIMP_RGB, + GIMP_PRECISION_U16_NON_LINEAR); +@@ -298,12 +309,19 @@ load_image (GFile *file, + gimp_image_get_default_new_layer_mode (image)); + gimp_image_insert_layer (image, layer, NULL, 0); + +- buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer)); ++ pixels = g_try_malloc (row_size); ++ if (pixels == NULL) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("There was not enough memory to complete the " ++ "operation.")); ++ fclose (fp); ++ return NULL; ++ } + ++ buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer)); + for (gint i = 0; i < height; i++) + { +- pixels = g_malloc (row_size); +- + if (! fread (pixels, row_size, 1, fp)) + { + g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), +@@ -318,9 +336,8 @@ load_image (GFile *file, + gegl_buffer_set (buffer, + GEGL_RECTANGLE (0, i, width, 1), 0, + format, pixels, GEGL_AUTO_ROWSTRIDE); +- +- g_free (pixels); + } ++ g_free (pixels); + + fclose (fp); + g_object_unref (buffer); +-- +GitLab + diff --git a/gimp-CVE-2025-10925.patch b/gimp-CVE-2025-10925.patch new file mode 100644 index 0000000..240e909 --- /dev/null +++ b/gimp-CVE-2025-10925.patch @@ -0,0 +1,46 @@ +From 002b22c15028b18557bd0823a081af9ed5316679 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Thu, 4 Sep 2025 04:45:43 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-27793 + +GIMP ILBM File Parsing Stack-based Buffer Overflow +Remote Code Execution Vulnerability + +Adds a check to file-iff.c to ensure the palette_size is +between 0 and 256. +--- + plug-ins/common/file-iff.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/plug-ins/common/file-iff.c b/plug-ins/common/file-iff.c +index 6c1418950d..d144a96a4c 100644 +--- a/plug-ins/common/file-iff.c ++++ b/plug-ins/common/file-iff.c +@@ -328,7 +328,9 @@ load_image (GFile *file, + bitMapHeader = true_image->bitMapHeader; + if (! bitMapHeader || ! true_image->body) + { +- g_message (_("ILBM contains no image data - likely a palette file")); ++ g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), ++ _("ILBM contains no image data - likely a palette " ++ "file")); + return NULL; + } + +@@ -355,6 +357,13 @@ load_image (GFile *file, + { + palette_size = colorMap->colorRegisterLength; + ++ if (palette_size < 0 || palette_size > 256) ++ { ++ g_set_error (error, G_FILE_ERROR, g_file_error_from_errno (errno), ++ _("Invalid ILBM colormap size")); ++ return NULL; ++ } ++ + for (gint j = 0; j < palette_size; j++) + { + gimp_cmap[j * 3] = colorMap->colorRegister[j].red; +-- +2.49.0 + diff --git a/gimp-CVE-2025-14422.patch b/gimp-CVE-2025-14422.patch new file mode 100644 index 0000000..618ad4c --- /dev/null +++ b/gimp-CVE-2025-14422.patch @@ -0,0 +1,63 @@ +From 4ff2d773d58064e6130495de498e440f4a6d5edb Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 23 Nov 2025 16:43:51 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-28273 + +Resolves #15286 +Adds a check to the memory allocation +in pnm_load_raw () with g_size_checked_mul () +to see if the size would go out of bounds. +If so, we don't try to allocate and load the +image. +--- + plug-ins/common/file-pnm.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c +index 32a33a4f35..9d349e967e 100644 +--- a/plug-ins/common/file-pnm.c ++++ b/plug-ins/common/file-pnm.c +@@ -674,7 +674,7 @@ load_image (GFile *file, + GError **error) + { + GInputStream *input; +- GeglBuffer *buffer; ++ GeglBuffer *buffer = NULL; + GimpImage * volatile image = NULL; + GimpLayer *layer; + char buf[BUFLEN + 4]; /* buffer for random things like scanning */ +@@ -708,6 +708,9 @@ load_image (GFile *file, + g_object_unref (input); + g_free (pnminfo); + ++ if (buffer) ++ g_object_unref (buffer); ++ + if (image) + gimp_image_delete (image); + +@@ -1060,6 +1063,7 @@ pnm_load_raw (PNMScanner *scan, + const Babl *format = NULL; + gint bpc; + guchar *data, *d; ++ gsize data_size; + gushort *s; + gint x, y, i; + gint start, end, scanlines; +@@ -1070,7 +1074,12 @@ pnm_load_raw (PNMScanner *scan, + bpc = 1; + + /* No overflow as long as gimp_tile_height() < 1365 = 2^(31 - 18) / 6 */ +- data = g_new (guchar, gimp_tile_height () * info->xres * info->np * bpc); ++ if (! g_size_checked_mul (&data_size, gimp_tile_height (), info->xres) || ++ ! g_size_checked_mul (&data_size, data_size, info->np) || ++ ! g_size_checked_mul (&data_size, data_size, bpc)) ++ CHECK_FOR_ERROR (FALSE, info->jmpbuf, _("Unsupported maximum value.")); ++ ++ data = g_new (guchar, data_size); + + input = pnmscanner_input (scan); + +-- +2.52.0 + diff --git a/gimp-CVE-2025-14423.patch b/gimp-CVE-2025-14423.patch new file mode 100644 index 0000000..30c0bfc --- /dev/null +++ b/gimp-CVE-2025-14423.patch @@ -0,0 +1,103 @@ +From 481cdbbb97746be1145ec3a633c567a68633c521 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 23 Nov 2025 04:22:49 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-28311 + +Resolves #15292 +The IFF specification states that EHB format images +have exactly 32 colors in their palette. However, it +is possible for images in the wild to place an incorrect +palette size. This patch checks for this, and either limits +the palette size or breaks accordingly. +--- + plug-ins/common/file-iff.c | 32 ++++++++++++++++++++++---------- + 1 file changed, 22 insertions(+), 10 deletions(-) + +diff --git a/plug-ins/common/file-iff.c b/plug-ins/common/file-iff.c +index d144a96a4c..f0879470c2 100644 +--- a/plug-ins/common/file-iff.c ++++ b/plug-ins/common/file-iff.c +@@ -337,7 +337,7 @@ load_image (GFile *file, + width = bitMapHeader->w; + height = bitMapHeader->h; + nPlanes = bitMapHeader->nPlanes; +- row_length = (width + 15) / 16; ++ row_length = ((width + 15) / 16) * 2; + pixel_size = nPlanes / 8; + aspect_x = bitMapHeader->xAspect; + aspect_y = bitMapHeader->yAspect; +@@ -375,6 +375,18 @@ load_image (GFile *file, + { + /* EHB mode adds 32 more colors. Each are half the RGB values + * of the first 32 colors */ ++ if (palette_size < 32) ++ { ++ g_set_error (error, G_FILE_ERROR, ++ g_file_error_from_errno (errno), ++ _("Invalid ILBM colormap size")); ++ return NULL; ++ } ++ else if (palette_size > 32) ++ { ++ palette_size = 32; ++ } ++ + for (gint j = 0; j < palette_size * 2; j++) + { + gint offset_index = j + 32; +@@ -386,7 +398,7 @@ load_image (GFile *file, + gimp_cmap[offset_index * 3 + 2] = + colorMap->colorRegister[j].blue / 2; + } +- /* EHB mode always has 64 colors */ ++ /* EHB mode always has 64 colors in total */ + palette_size = 64; + } + } +@@ -447,7 +459,7 @@ load_image (GFile *file, + { + guchar *pixel_row; + +- pixel_row = g_malloc (width * pixel_size * sizeof (guchar)); ++ pixel_row = g_malloc0 (width * pixel_size); + + /* PBM uses one byte per pixel index */ + if (ILBM_imageIsPBM (true_image)) +@@ -459,7 +471,7 @@ load_image (GFile *file, + else + deleave_rgb_row (bitplanes, pixel_row, width, nPlanes, pixel_size); + +- bitplanes += (row_length * 2 * nPlanes); ++ bitplanes += (row_length * nPlanes); + + gegl_buffer_set (buffer, GEGL_RECTANGLE (0, y_height, width, 1), 0, + NULL, pixel_row, GEGL_AUTO_ROWSTRIDE); +@@ -528,7 +540,7 @@ deleave_ham_row (const guchar *gimp_cmap, + /* Deleave rows */ + for (gint i = 0; i < row_length; i++) + { +- for (gint j = 0; j < 8; j++) ++ for (gint j = 0; j < nPlanes; j++) + { + guint8 bitmask = (1 << (8 - j)) - (1 << (7 - j)); + guint8 control = 0; +@@ -590,11 +602,11 @@ deleave_ham_row (const guchar *gimp_cmap, + } + + static void +-deleave_rgb_row (IFF_UByte *bitplanes, +- guchar *pixel_row, +- gint width, +- gint nPlanes, +- gint pixel_size) ++deleave_rgb_row (IFF_UByte *bitplanes, ++ guchar *pixel_row, ++ gint width, ++ gint nPlanes, ++ gint pixel_size) + { + gint row_length = ((width + 15) / 16) * 2; + gint current_pixel = 0; +-- +2.52.0 + diff --git a/gimp-CVE-2025-14424.patch b/gimp-CVE-2025-14424.patch new file mode 100644 index 0000000..48483e5 --- /dev/null +++ b/gimp-CVE-2025-14424.patch @@ -0,0 +1,31 @@ +From 5cc55d078b7fba995cef77d195fac325ee288ddd Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Thu, 13 Nov 2025 18:26:51 -0500 +Subject: [PATCH] app: fix #15288 crash when loading malformed xcf + +ZDI-CAN-28376 vulnerability + +Add extra tests to not crash on a NULL g_class. +--- + app/core/gimpitemlist.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/app/core/gimpitemlist.c b/app/core/gimpitemlist.c +index 93dfc83427..5aeb4916d8 100644 +--- a/app/core/gimpitemlist.c ++++ b/app/core/gimpitemlist.c +@@ -345,7 +345,10 @@ gimp_item_list_named_new (GimpImage *image, + g_return_val_if_fail (GIMP_IS_IMAGE (image), NULL); + + for (iter = items; iter; iter = iter->next) +- g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL); ++ { ++ g_return_val_if_fail (iter->data && ((GTypeInstance*) (iter->data))->g_class, NULL); ++ g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL); ++ } + + if (! items) + { +-- +2.52.0 + diff --git a/gimp-CVE-2025-14425.patch b/gimp-CVE-2025-14425.patch new file mode 100644 index 0000000..f833a76 --- /dev/null +++ b/gimp-CVE-2025-14425.patch @@ -0,0 +1,69 @@ +From cd1c88a0364ad1444c06536731972a99bd8643fd Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 12 Nov 2025 13:25:44 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-28248 for JP2 images + +Resolves #15285 +Per the report, it's possible to exceed the size of the pixel buffer +with a high precision_scaled value, as we size it to the width * bpp. +This patch includes precision_scaled in the allocation calculation. +It also adds a g_size_checked_mul () check to ensure there's no +overflow, and moves the pixel and buffer memory freeing to occur +in the out section so that it always runs even on failure. +--- +diff -urp gimp-3.0.6.orig/plug-ins/common/file-jp2-load.c gimp-3.0.6/plug-ins/common/file-jp2-load.c +--- gimp-3.0.6.orig/plug-ins/common/file-jp2-load.c 2025-10-05 12:14:02.000000000 -0500 ++++ gimp-3.0.6/plug-ins/common/file-jp2-load.c 2026-01-16 13:01:30.366333187 -0600 +@@ -1045,14 +1045,15 @@ load_image (GimpProcedure *procedure + GimpColorProfile *profile = NULL; + GimpImage *gimp_image = NULL; + GimpLayer *layer; ++ GeglBuffer *buffer = NULL; ++ guchar *pixels = NULL; ++ gsize pixels_size; + GimpImageType image_type; + GimpImageBaseType base_type; + gint width; + gint height; + gint num_components; +- GeglBuffer *buffer; + gint i, j, k, it; +- guchar *pixels; + const Babl *file_format; + gint bpp; + GimpPrecision image_precision; +@@ -1318,7 +1319,15 @@ load_image (GimpProcedure *procedure + bpp = babl_format_get_bytes_per_pixel (file_format); + + buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer)); +- pixels = g_new0 (guchar, width * bpp); ++ ++ if (! g_size_checked_mul (&pixels_size, width, (bpp * (precision_scaled / 8)))) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("Defined row size is too large in JP2 image '%s'."), ++ gimp_file_get_utf8_name (file)); ++ goto out; ++ } ++ pixels = g_new0 (guchar, pixels_size); + + for (i = 0; i < height; i++) + { +@@ -1344,13 +1353,13 @@ load_image (GimpProcedure *procedure + gegl_buffer_set (buffer, GEGL_RECTANGLE (0, i, width, 1), 0, + file_format, pixels, GEGL_AUTO_ROWSTRIDE); + } +- +- g_free (pixels); +- +- g_object_unref (buffer); + gimp_progress_update (1.0); + + out: ++ if (pixels) ++ g_free (pixels); ++ if (buffer) ++ g_object_unref (buffer); + if (profile) + g_object_unref (profile); + if (image) diff --git a/gimp-CVE-2025-15059.patch b/gimp-CVE-2025-15059.patch new file mode 100644 index 0000000..4aeac2e --- /dev/null +++ b/gimp-CVE-2025-15059.patch @@ -0,0 +1,38 @@ +From 03575ac8cbb0ef3103b0a15d6598475088dcc15e Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Sat, 20 Dec 2025 10:10:48 -0500 +Subject: [PATCH] plug-ins: fix #15284 ZDI-CAN-28232 vulnerability in file-psp + +We were not checking whether channel types were valid for grayscale +images. Using a blue color channel caused an invalid computation of +the offset which could cause us to access an invalid memory location. + +Now we separate RGB from non-RGB images when checking which channels +are valid, and if not return with an error. +--- + plug-ins/common/file-psp.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/plug-ins/common/file-psp.c b/plug-ins/common/file-psp.c +index f00251c573..3f6970561f 100644 +--- a/plug-ins/common/file-psp.c ++++ b/plug-ins/common/file-psp.c +@@ -2171,11 +2171,12 @@ read_layer_block (FILE *f, + } + else + { +- if (channel_type > PSP_CHANNEL_BLUE) ++ if ((ia->base_type == GIMP_RGB && channel_type > PSP_CHANNEL_BLUE) || ++ (ia->base_type != GIMP_RGB && channel_type >= PSP_CHANNEL_RED)) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, +- _("Invalid channel type %d in channel information chunk"), +- channel_type); ++ _("Invalid channel type %d in channel information chunk"), ++ channel_type); + return NULL; + } + +-- +2.51.0 + diff --git a/gimp.changes b/gimp.changes new file mode 100644 index 0000000..448e5b9 --- /dev/null +++ b/gimp.changes @@ -0,0 +1,3816 @@ +------------------------------------------------------------------- +Fri Jan 16 17:52:35 UTC 2026 - Michael Gorse + +- Add CVE fixes: + + gimp-CVE-2025-14422.patch (bsc#1255293 CVE-2025-14422) + + gimp-CVE-2025-14423.patch (bsc#1255294 CVE-2025-14423) + + gimp-CVE-2025-14424.patch (bsc#1255295 CVE-2025-14424) + + gimp-CVE-2025-14425.patch (bsc#1255296 CVE-2025-14425) + +------------------------------------------------------------------- +Wed Jan 7 06:06:45 UTC 2026 - Xiaoguang Wang + +- Add gimp-CVE-2025-15059.patch: vulnerability in file-psp + (CVE-2025-15059, ZDI-CAN-28232, bsc#1255766). + +------------------------------------------------------------------- +Mon Dec 1 07:26:22 UTC 2025 - JS + +- Relax the gtk3_version requirement so that Leap 16.0 can build + +------------------------------------------------------------------- +Tue Oct 7 01:06:50 UTC 2025 - Marcus Rueckert + +- switch from pkgconfig(appstream-glib) to pkgconfig(appstream) + +------------------------------------------------------------------- +Tue Oct 7 00:56:55 UTC 2025 - Marcus Rueckert + +- Update to 3.0.6 + - Security: + - During development, we received reports from the Zero Day + Initiative of potential security issues with some of our file + import plug-ins. While these issues are very unlikely to + occur with real files, developers like Jacob Boerema and Alx + Sa proactively improved security for those imports. + The resolved reports are: + - ZDI-CAN-27793 + - ZDI-CAN-27823 + - ZDI-CAN-27836 + - ZDI-CAN-27878 + - ZDI-CAN-27684 + - fix dicom plug-in: + Adds more safety checks and sets actual GError's instead of just + calling gimp_quit. Fix GIMP DCM File Parsing Heap-based Buffer + Overflow Remote Code Execution Vulnerability + (CVE-2025-10922, ZDI-CAN-27863, bsc#1250497) + - Core: + - Many false-positive build warnings have been cleaned out (and + proper issues fixed). + - Various crashes fixed. + - When creating a layer mask from the layer's alpha, but the + layer has no alpha, simply fill the mask with complete + opacity instead of a completely transparent layer. + - Various core infrastructure code reviewed, cleaned up, + refactored and improved, in drawable, layer and filter + handling code, tree view code, and more. + - GIMP_ICONS_LIKE_A_BOSS environment variable is not working + anymore (because "gtk-menu-images" and "gtk-button-images" + have been deprecated in GTK3 and removed in GTK4) and was + therefore removed. + - Lock Content now shows as an undo step. + - Add alpha channel for certain transforms. + - Add alpha channel on filter merge, when necessary. + - Filters can now be applied non-destructively on channels. + - Improved Photoshop brush support. + - After deleting a palette entry, the next entry is + automatically selected. This allows easily deleting several + entries in a row, among other usage. + - Resize image to layers irrespective to selections. + - Improved in-GUI release notes' demo script language: + - We can now set a button value to click it: "toolbox:text, + tool-options:outline=1, tool-options:outline-direction" + - Color selector's module names can be used as identifiers: + "color-editor,color-editor:CMYK=1,color-editor:total-ink-coverage" + - Fixed Alpha to Selection on single layers with no + transparency. + - Various code is slowly ported to newer code, preparing for + GTK4 port (in an unplanned future step): + - Using g_set_str() (optionally redefining it in our core + code to avoid bumping the GLib minimum requirement). + - Start using GListModel in various pieces of code, in + particular getting rid of more and more usage of + GtkTreeView when possible (as it will be deprecated with + GTK4). + - New GimpRow class for all future row widgets. + - Use more of G_DECLARE_DERIVABLE_TYPE and + G_DECLARE_FINAL_TYPE where relevant. + - New GimpContainerListView using a GtkListBox. + - New GimpRowSeparator, GimpRowSettings, GimpRowFilter and + GimpRowDrawableFilter widgets. + - (Experimental) GEX Format was updated. + - Palette import: + - Set alpha value for image palette imports. + - Fix Lab & CMYK ACB palette import. + - Add palette format filters to import dialog, making it more + apparent what palette formats are supported, and giving the + ability to hide irrelevant files. + - Improved filter actions' sensitivity to make sure they are + set insensitive when relevant. In particular filters which + cannot be run non-destructively (e.g. filters with aux + inputs, non-interactive filters and GEGL Graph) must be + insensitive when trying to run them on group layers. + - Fix bad axis centering on zoom out. + - Export better SVG when exporting paths. + - Tools: + - Text tool: make sure the default color is only changed when + the user confirms the color change. + - Foreground Selection tool: do not create a selection when no + strokes has been made. In particular this removes the + unnecessary delay which happened when switching to another + tool without actually stroking anything. + - All Transform tools: transform boundaries for preview is now + multi-layers aware. + - (Experimental) Seamless Clone tool: made to work again, + though it is still too slow to get out of Playground. + - Graphical User Interface: + - Various improvements to window management: + - Keep-Above windows are set with the Utility hint. + - Utility windows are not made transient to a parent. + - Transient factory dialogs follow the active display, + ensuring that new image windows would not hide your toolbox + and dock windows. + - Various CSS improvements for styling of the interface. Some + theme leaks were also fixed. + - New toggle button in Brushes and Fonts dockable, allowing + brush and font previews to optionally follow the color theme. + For instance, when using a dark theme, the brush and font + previews could be drawn on the theme background, using the + theme foreground colors. By default, these data previews are + still drawn as black on white. + - Palette grid is now drawn with the theme's background color. + - Consistent naming patterns on human-facing options (first + word only capitalized). + - About dialog: + - We will now display the date and time of the last check in + a "Up to date as of at