rpms/gimp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import Oracle_OSS gimp-3.0.4-4.el9_8.10

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-09-02 01:44:02 -04:00
parent 777d9608e5
commit 26e177b067
10 changed files with 439 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
SOURCES/gimp-CVE-2026-18301.patch Normal file
View File

@ -0,0 +1,64 @@
From b1f46e63c82065bd60e84359fb729380d5b043bf Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 18 Apr 2026 15:50:19 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29395
Resolves #16244
This patch increases certain variables from guint32
to gsize to prevent potential overflows. It also adds
checks to ensure we fail gracefully if we can't allocate
enough memory for loading channels.
Adapted for GIMP 3.0.4.
---
--- a/plug-ins/file-psd/psd-load.c 2026-08-24 13:54:30.042547619 +0200
+++ b/plug-ins/file-psd/psd-load.c 2026-08-24 13:54:52.045397667 +0200
@@ -3375,28 +3375,39 @@ read_channel_data (PSDchannel *chann
guint32 comp_len,
GError **error)
{
- gchar *raw_data = NULL;
- gchar *src;
- guint32 readline_len;
+ gchar *raw_data = NULL;
+ gchar *src;
+ gsize readline_len;
+ gsize allocation;
if (bps == 1)
- readline_len = ((channel->columns + 7) / 8);
+ readline_len = (gsize) ((channel->columns + 7) / 8);
else
- readline_len = (channel->columns * bps / 8);
+ readline_len = (gsize) (channel->columns * bps / 8);
- IFDBG(4) g_debug ("raw data size %d x %d = %d", readline_len,
+ IFDBG(4) g_debug ("raw data size %" G_GSIZE_FORMAT " x %d = %" G_GSIZE_FORMAT,
+ readline_len,
channel->rows, readline_len * channel->rows);
/* sanity check, int overflow check (avoid divisions by zero) */
- if ((channel->rows == 0) || (channel->columns == 0) ||
- (channel->rows > G_MAXINT32 / channel->columns / MAX (bps / 8, 1)))
+ if ((channel->rows == 0) || (channel->columns == 0) ||
+ (channel->rows >= G_MAXINT32 / channel->columns / MAX (bps / 8, 1)) ||
+ ! g_size_checked_mul (&allocation, readline_len, channel->rows))
{
g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
_("Unsupported or invalid channel size"));
return -1;
}
- raw_data = g_malloc (readline_len * channel->rows);
+ raw_data = g_try_malloc (allocation);
+ if (raw_data == NULL)
+ {
+ g_set_error (error, GIMP_PLUG_IN_ERROR, 0,
+ _("There was not enough memory to complete the "
+ "operation."));
+ return -1;
+ }
+
switch (compression)
{
case PSD_COMP_RAW:

24
SOURCES/gimp-CVE-2026-18302.patch Normal file
View File

@ -0,0 +1,24 @@
From 77e1a11636fae53c922fe92273b8f4e33c7a9176 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Mon, 20 Apr 2026 12:35:40 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29398
Resolves #16246
In the TIFF image loader, we call convert_int2uint () on both
load_separate () and load_contiguous (). However, load_separate ()
should be working on individual planes rather than the whole image.
Therefore, instead of incrementing the pixel index by the total number
of bytes per pixel, we should only increment by the number of bits
per channel.
---
--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 13:58:20.038199048 +0200
+++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 13:59:00.050707946 +0200
@@ -2247,7 +2247,7 @@ load_separate (TIFF *tif,
else if (is_signed)
{
convert_int2uint (buffer, bps, 1, cols, rows,
- tile_width * bytes_per_pixel);
+ tile_width * (bps / 8));
}
if (tiff_mode == GIMP_TIFF_GRAY_MINISWHITE && bps == 8)

32
SOURCES/gimp-CVE-2026-18303.patch Normal file
View File

@ -0,0 +1,32 @@
From 5633b362026c6e5b2beb559a10cd76fa32a47592 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 18 Apr 2026 17:15:06 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29399
Resolves #16247
We do not yet support indexed images with color maps
larger than 256 colors. It is possible for a multi-page
TIFF to have the first page be within range, but other
pages to be larger than that. This results in buffer overflows
when writing to the color map.
This patch adds another check at colormap creation, in addition to
the existing check when creating the indexed TIFF image.
---
--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:01:48.399539137 +0200
+++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:03:06.006032046 +0200
@@ -1438,6 +1438,15 @@ load_image (GimpProcedure *proced
return GIMP_PDB_EXECUTION_ERROR;
}
+ /* TODO: Remove when we support 16 bit indexed TIFFs */
+ if (bps > 8)
+ {
+ TIFFClose (tif);
+ g_message (_("Indexed TIFFs with color maps larger than 256"
+ "colors are not yet supported"));
+ return GIMP_PDB_EXECUTION_ERROR;
+ }
+
for (i = 0, j = 0; i < (1 << bps); i++)
{
cmap[j++] = redmap[i] >> 8;

57
SOURCES/gimp-CVE-2026-18304.patch Normal file
View File

@ -0,0 +1,57 @@
From ad32d22c347674fa1bb5b60935c376b673d946e7 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 18 Apr 2026 01:01:47 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29403
Resolves #16245
In the TIFF plug-in, the bw_buffer is allocated with
tile_width * tile_height. Since these are both guint32,
when multiplied they can potentially overflow with large
enough values. This patch casts them to gsize and uses
g_try_malloc () to verify we were able to allocate that
much space.
---
--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:05:48.954840819 +0200
+++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:06:37.599544217 +0200
@@ -1985,8 +1985,19 @@ load_contiguous (TIFF *tif,
if (tiff_mode != GIMP_TIFF_DEFAULT && bps < 8)
{
+ gsize tile_area = (gsize) tile_width * tile_height;
+
needs_upscale = TRUE;
- bw_buffer = g_malloc (tile_width * tile_height);
+ bw_buffer = g_try_malloc (tile_area);
+
+ if (! bw_buffer)
+ {
+ g_message (_("There was not enough memory to complete the "
+ "operation."));
+ g_free (buffer);
+ g_free (bw_buffer);
+ return;
+ }
}
one_row = (gdouble) tile_height / (gdouble) image_height;
@@ -2162,8 +2173,19 @@ load_separate (TIFF *tif,
if (tiff_mode != GIMP_TIFF_DEFAULT && bps < 8)
{
+ gsize tile_area = (gsize) tile_width * tile_height;
+
needs_upscale = TRUE;
- bw_buffer = g_malloc (tile_width * tile_height);
+ bw_buffer = g_try_malloc (tile_area);
+
+ if (! bw_buffer)
+ {
+ g_message (_("There was not enough memory to complete the "
+ "operation."));
+ g_free (buffer);
+ g_free (bw_buffer);
+ return;
+ }
}
one_row = (gdouble) tile_height / (gdouble) image_height;

35
SOURCES/gimp-CVE-2026-18305.patch Normal file
View File

@ -0,0 +1,35 @@
From 0a45a2b51b877829ef523131b50c0eb2a933b8a1 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sun, 19 Apr 2026 03:16:09 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29406
Resolves #16248
This patch uses g_size_check_mul () and g_try_malloc0 ()
to ensure we allocate enough memory for very large TIFF
images when importing RGBA pixels.
---
--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:11:23.595515987 +0200
+++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:12:17.205188294 +0200
@@ -1895,13 +1895,21 @@ load_rgba (TIFF *tif,
guint32 image_height;
guint32 row;
guint32 *buffer;
+ gsize allocation;
g_printerr ("%s\n", __func__);
TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &image_width);
TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &image_height);
- buffer = g_new (uint32_t, image_width * image_height);
+ if (! g_size_checked_mul (&allocation, image_width, image_height) ||
+ ! g_size_checked_mul (&allocation, allocation, 4) ||
+ (buffer = g_try_malloc0 (allocation)) == NULL)
+ {
+ g_message (_("There was not enough memory to complete the "
+ "operation."));
+ return;
+ }
if (! TIFFReadRGBAImage (tif, image_width, image_height, buffer, 0))
{

38
SOURCES/gimp-CVE-2026-18306.patch Normal file
View File

@ -0,0 +1,38 @@
From 76531da9732f38566e5fd8f8f80c837158511ae5 Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 18 Apr 2026 18:48:27 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29396
Resolves #16249
This patch adds a check for the SGI read in
bpp being within acceptable ranges (1 or 2).
It also casts pointer arithmetic to gsize
(similar to other areas of the SGI code)
to prevent overflow.
---
--- a/plug-ins/file-sgi/sgi-lib.c 2026-08-24 14:15:20.184975908 +0200
+++ b/plug-ins/file-sgi/sgi-lib.c 2026-08-24 14:16:27.320383060 +0200
@@ -317,6 +317,12 @@ sgiOpenFile(FILE *file, /* I - File to o
sgip->comp = getc(sgip->file);
sgip->bpp = getc(sgip->file);
+ if (sgip->bpp > 2)
+ {
+ free (sgip);
+ return (NULL);
+ }
+
getshort(sgip); /* Dimensions */
sgip->xsize = getshort(sgip);
sgip->ysize = getshort(sgip);
--- a/plug-ins/file-sgi/sgi.c 2026-08-24 14:15:20.187244504 +0200
+++ b/plug-ins/file-sgi/sgi.c 2026-08-24 14:16:59.125153491 +0200
@@ -474,7 +474,7 @@ load_image (GFile *file,
pixels[0] = g_new (guchar, ((gsize) tile_height) * sgip->xsize * sgip->bpp * bytes);
for (i = 1; i < tile_height; i ++)
- pixels[i] = pixels[0] + sgip->xsize * sgip->bpp * bytes * i;
+ pixels[i] = pixels[0] + (((gsize) sgip->xsize) * sgip->bpp * bytes * i);
rows = g_new (unsigned short *, sgip->zsize);
rows[0] = g_new (unsigned short, ((gsize) sgip->xsize) * sgip->zsize);

27
SOURCES/gimp-CVE-2026-18307.patch Normal file
View File

@ -0,0 +1,27 @@
From bace3e7fd54104fe6b70c1703e9b982a4770811d Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Fri, 5 Jun 2026 18:00:21 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29404
Resolves #16250
It is possible for the samples per pixel value to
be less than the photometric setting. In these
cases, we want to use the SPP value for the
main drawable first, then add additional channels
if they exist.
Adapted for GIMP 3.0.4.
---
--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:20:35.250053819 +0200
+++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:21:14.126312877 +0200
@@ -1994,8 +1994,8 @@ load_contiguous (TIFF *tif,
src_format = babl_format_n (type, spp);
/* consistency check */
- bytes_per_pixel = 0;
- for (i = 0; i <= extra; i++)
+ bytes_per_pixel = babl_format_get_bytes_per_pixel (src_format);
+ for (i = 1; i <= extra; i++)
bytes_per_pixel += babl_format_get_bytes_per_pixel (channel[i].format);
g_printerr ("bytes_per_pixel: %d, format: %d\n",

51
SOURCES/gimp-CVE-2026-18308.patch Normal file
View File

@ -0,0 +1,51 @@
From d84f8e58f56681a0b4c66129c568cb796725ab9d Mon Sep 17 00:00:00 2001
From: Alx Sa <cmyk.student@gmail.com>
Date: Sat, 18 Apr 2026 18:15:41 +0000
Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29405
Resolves #16251
Adds image size boundary checks for Sketchbook TIFF layers.
Also, verifies that the allocated buffer has not overflowed
before trying to read in data to it.
---
--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:24:50.062641708 +0200
+++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:25:41.101385919 +0200
@@ -2407,6 +2407,7 @@ load_sketchbook_layers (TIFF *tif,
gboolean visible = TRUE;
gboolean locked = FALSE;
guint32 *pixels;
+ gsize pixels_size;
guint32 row;
layer_settings = g_strsplit (alias_sublayer_info, ", ", 10);
@@ -2427,6 +2428,22 @@ load_sketchbook_layers (TIFF *tif,
TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &layer_width);
TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &layer_height);
+ if (layer_width > GIMP_MAX_IMAGE_SIZE ||
+ layer_height > GIMP_MAX_IMAGE_SIZE)
+ {
+ g_message (_("Invalid image dimensions (%u x %u) for "
+ "Sketchbook layer %i. Image may be corrupt."),
+ layer_width, layer_height, i + 1);
+ continue;
+ }
+
+ if (! g_size_checked_mul (&pixels_size, layer_width, layer_height) ||
+ ! g_size_checked_mul (&pixels_size, pixels_size, 4) ||
+ (pixels = g_try_malloc0 (pixels_size)) == NULL)
+ {
+ g_free (pixels);
+ continue;
+ }
if (! TIFFGetField (tif, TIFFTAG_XPOSITION, &x_pos))
x_pos = 0.0f;
@@ -2441,7 +2458,6 @@ load_sketchbook_layers (TIFF *tif,
gimp_image_insert_layer (image, layer, NULL, -1);
/* Loading pixel data */
- pixels = g_new (uint32_t, layer_width * layer_height);
if (! TIFFReadRGBAImage (tif, layer_width, layer_height, pixels, 0))
{
g_free (pixels);

81
SOURCES/gimp-CVE-2026-59090.patch Normal file
View File

@ -0,0 +1,81 @@
From 612c7e0a5775e7883789022c61f85a1c82c05505 Mon Sep 17 00:00:00 2001
From: Jacob Boerema <jgboerema@gmail.com>
Date: Tue, 30 Jun 2026 15:50:17 -0400
Subject: [PATCH] plug-ins: mitigate issue #16509
We received a report by Feng Xue that our PSD loader does not handle
underflow when updating unsigned block_rem, which allows an attacker
to inject data using a specially crafted psd.
After investigation there were more locations where the same issue
theoreticaly could happen, so we add checks everywhere to make sure
we abort with an error in an underflow situation.
Adapted for GIMP 3.0.4.
---
--- a/plug-ins/file-psd/psd-load.c 2026-08-24 13:36:01.524667212 +0200
+++ b/plug-ins/file-psd/psd-load.c 2026-08-24 13:37:28.342060956 +0200
@@ -1214,6 +1214,16 @@ read_layer_info (PSDimage *img_a,
if (! img_a->ibm_pc_format)
block_len = GUINT32_FROM_BE (block_len);
+
+ if (block_len + 4 > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, block_len);
+ free_lyr_a (lyr_a, img_a->num_layers);
+ return NULL;
+ }
+
block_rem -= (block_len + 4);
IFDBG(3) g_debug ("Blending ranges size %" G_GSIZE_FORMAT
" (not imported)", block_len);
@@ -1238,6 +1248,15 @@ read_layer_info (PSDimage *img_a,
return NULL;
}
+ if (read_len > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) read_len);
+ free_lyr_a (lyr_a, img_a->num_layers);
+ return NULL;
+ }
+
block_rem -= read_len;
IFDBG(3) g_debug ("Offset: %" G_GOFFSET_FORMAT ", Remaining length %" G_GSIZE_FORMAT,
PSD_TELL(input), block_rem);
@@ -1258,6 +1277,14 @@ read_layer_info (PSDimage *img_a,
free_lyr_a (lyr_a, img_a->num_layers);
return NULL;
}
+ if (header_size > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) header_size);
+ free_lyr_a (lyr_a, img_a->num_layers);
+ return NULL;
+ }
block_rem -= header_size;
@@ -1286,6 +1313,15 @@ read_layer_info (PSDimage *img_a,
free_lyr_a (lyr_a, img_a->num_layers);
return NULL;
}
+ if (res_a.data_len > block_rem)
+ {
+ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED,
+ _("Invalid block size."));
+ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, res_a.data_len);
+ free_lyr_a (lyr_a, img_a->num_layers);
+ return NULL;
+ }
+
block_rem -= res_a.data_len;
IFDBG(3) g_debug ("Remaining length in block: %" G_GSIZE_FORMAT, block_rem);
}

31
SPECS/gimp.spec
View File

@ -67,7 +67,7 @@ Name: gimp
Epoch: 2
Version: 3.0.4
%global rel 4
Release: %{rel}%{?dist}.9
Release: %{rel}%{?dist}.10
# https://bugzilla.redhat.com/show_bug.cgi?id=2318369
ExcludeArch: s390x
@ -286,6 +286,15 @@ Patch25: gimp-CVE-2026-66758.patch
# https://gitlab.gnome.org/GNOME/gimp/-/commit/691785113a
# https://gitlab.gnome.org/GNOME/gimp/-/commit/7dff816fbd
Patch26: gimp-CVE-2026-42169.patch
Patch27: gimp-CVE-2026-59090.patch
Patch28: gimp-CVE-2026-18301.patch
Patch29: gimp-CVE-2026-18302.patch
Patch30: gimp-CVE-2026-18303.patch
Patch31: gimp-CVE-2026-18304.patch
Patch32: gimp-CVE-2026-18305.patch
Patch33: gimp-CVE-2026-18306.patch
Patch34: gimp-CVE-2026-18307.patch
Patch35: gimp-CVE-2026-18308.patch
# use external help browser directly if help browser plug-in is not built
Patch100: gimp-3.0.2-external-help-browser.patch
@ -384,6 +393,15 @@ EOF
%patch24 -p1 -b .CVE-2026-66759
%patch25 -p1 -b .CVE-2026-66758
%patch26 -p1 -b .CVE-2026-42169
%patch27 -p1 -b .CVE-2026-59090
%patch28 -p1 -b .CVE-2026-18301
%patch29 -p1 -b .CVE-2026-18302
%patch30 -p1 -b .CVE-2026-18303
%patch31 -p1 -b .CVE-2026-18304
%patch32 -p1 -b .CVE-2026-18305
%patch33 -p1 -b .CVE-2026-18306
%patch34 -p1 -b .CVE-2026-18307
%patch35 -p1 -b .CVE-2026-18308
%patch100 -p1 -b .external-help-browser
@ -699,6 +717,17 @@ done
%endif
%changelog
* Mon Aug 24 2026 Josef Ridky <jridky@redhat.com> - 2:3.0.4-4.10
- fix CVE-2026-59090
- fix CVE-2026-18301
- fix CVE-2026-18302
- fix CVE-2026-18303
- fix CVE-2026-18304
- fix CVE-2026-18305
- fix CVE-2026-18306
- fix CVE-2026-18307
- fix CVE-2026-18308
* Tue Aug 04 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:3.0.4-4.9
- fix CVE-2026-42169