diff --git a/SOURCES/gimp-CVE-2026-18301.patch b/SOURCES/gimp-CVE-2026-18301.patch new file mode 100644 index 0000000..ebedb4c --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18301.patch @@ -0,0 +1,64 @@ +From b1f46e63c82065bd60e84359fb729380d5b043bf Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 15:50:19 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29395 + +Resolves #16244 +This patch increases certain variables from guint32 +to gsize to prevent potential overflows. It also adds +checks to ensure we fail gracefully if we can't allocate +enough memory for loading channels. + +Adapted for GIMP 3.0.4. +--- +--- a/plug-ins/file-psd/psd-load.c 2026-08-24 13:54:30.042547619 +0200 ++++ b/plug-ins/file-psd/psd-load.c 2026-08-24 13:54:52.045397667 +0200 +@@ -3375,28 +3375,39 @@ read_channel_data (PSDchannel *chann + guint32 comp_len, + GError **error) + { +- gchar *raw_data = NULL; +- gchar *src; +- guint32 readline_len; ++ gchar *raw_data = NULL; ++ gchar *src; ++ gsize readline_len; ++ gsize allocation; + + if (bps == 1) +- readline_len = ((channel->columns + 7) / 8); ++ readline_len = (gsize) ((channel->columns + 7) / 8); + else +- readline_len = (channel->columns * bps / 8); ++ readline_len = (gsize) (channel->columns * bps / 8); + +- IFDBG(4) g_debug ("raw data size %d x %d = %d", readline_len, ++ IFDBG(4) g_debug ("raw data size %" G_GSIZE_FORMAT " x %d = %" G_GSIZE_FORMAT, ++ readline_len, + channel->rows, readline_len * channel->rows); + + /* sanity check, int overflow check (avoid divisions by zero) */ +- if ((channel->rows == 0) || (channel->columns == 0) || +- (channel->rows > G_MAXINT32 / channel->columns / MAX (bps / 8, 1))) ++ if ((channel->rows == 0) || (channel->columns == 0) || ++ (channel->rows >= G_MAXINT32 / channel->columns / MAX (bps / 8, 1)) || ++ ! g_size_checked_mul (&allocation, readline_len, channel->rows)) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Unsupported or invalid channel size")); + return -1; + } + +- raw_data = g_malloc (readline_len * channel->rows); ++ raw_data = g_try_malloc (allocation); ++ if (raw_data == NULL) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("There was not enough memory to complete the " ++ "operation.")); ++ return -1; ++ } ++ + switch (compression) + { + case PSD_COMP_RAW: diff --git a/SOURCES/gimp-CVE-2026-18302.patch b/SOURCES/gimp-CVE-2026-18302.patch new file mode 100644 index 0000000..45f2aa9 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18302.patch @@ -0,0 +1,24 @@ +From 77e1a11636fae53c922fe92273b8f4e33c7a9176 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Mon, 20 Apr 2026 12:35:40 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29398 + +Resolves #16246 +In the TIFF image loader, we call convert_int2uint () on both +load_separate () and load_contiguous (). However, load_separate () +should be working on individual planes rather than the whole image. +Therefore, instead of incrementing the pixel index by the total number +of bytes per pixel, we should only increment by the number of bits +per channel. +--- +--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 13:58:20.038199048 +0200 ++++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 13:59:00.050707946 +0200 +@@ -2247,7 +2247,7 @@ load_separate (TIFF *tif, + else if (is_signed) + { + convert_int2uint (buffer, bps, 1, cols, rows, +- tile_width * bytes_per_pixel); ++ tile_width * (bps / 8)); + } + + if (tiff_mode == GIMP_TIFF_GRAY_MINISWHITE && bps == 8) diff --git a/SOURCES/gimp-CVE-2026-18303.patch b/SOURCES/gimp-CVE-2026-18303.patch new file mode 100644 index 0000000..364ddbf --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18303.patch @@ -0,0 +1,32 @@ +From 5633b362026c6e5b2beb559a10cd76fa32a47592 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 17:15:06 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29399 + +Resolves #16247 +We do not yet support indexed images with color maps +larger than 256 colors. It is possible for a multi-page +TIFF to have the first page be within range, but other +pages to be larger than that. This results in buffer overflows +when writing to the color map. +This patch adds another check at colormap creation, in addition to +the existing check when creating the indexed TIFF image. +--- +--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:01:48.399539137 +0200 ++++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:03:06.006032046 +0200 +@@ -1438,6 +1438,15 @@ load_image (GimpProcedure *proced + return GIMP_PDB_EXECUTION_ERROR; + } + ++ /* TODO: Remove when we support 16 bit indexed TIFFs */ ++ if (bps > 8) ++ { ++ TIFFClose (tif); ++ g_message (_("Indexed TIFFs with color maps larger than 256" ++ "colors are not yet supported")); ++ return GIMP_PDB_EXECUTION_ERROR; ++ } ++ + for (i = 0, j = 0; i < (1 << bps); i++) + { + cmap[j++] = redmap[i] >> 8; diff --git a/SOURCES/gimp-CVE-2026-18304.patch b/SOURCES/gimp-CVE-2026-18304.patch new file mode 100644 index 0000000..1bfc9ab --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18304.patch @@ -0,0 +1,57 @@ +From ad32d22c347674fa1bb5b60935c376b673d946e7 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 01:01:47 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29403 + +Resolves #16245 +In the TIFF plug-in, the bw_buffer is allocated with +tile_width * tile_height. Since these are both guint32, +when multiplied they can potentially overflow with large +enough values. This patch casts them to gsize and uses +g_try_malloc () to verify we were able to allocate that +much space. +--- +--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:05:48.954840819 +0200 ++++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:06:37.599544217 +0200 +@@ -1985,8 +1985,19 @@ load_contiguous (TIFF *tif, + + if (tiff_mode != GIMP_TIFF_DEFAULT && bps < 8) + { ++ gsize tile_area = (gsize) tile_width * tile_height; ++ + needs_upscale = TRUE; +- bw_buffer = g_malloc (tile_width * tile_height); ++ bw_buffer = g_try_malloc (tile_area); ++ ++ if (! bw_buffer) ++ { ++ g_message (_("There was not enough memory to complete the " ++ "operation.")); ++ g_free (buffer); ++ g_free (bw_buffer); ++ return; ++ } + } + + one_row = (gdouble) tile_height / (gdouble) image_height; +@@ -2162,8 +2173,19 @@ load_separate (TIFF *tif, + + if (tiff_mode != GIMP_TIFF_DEFAULT && bps < 8) + { ++ gsize tile_area = (gsize) tile_width * tile_height; ++ + needs_upscale = TRUE; +- bw_buffer = g_malloc (tile_width * tile_height); ++ bw_buffer = g_try_malloc (tile_area); ++ ++ if (! bw_buffer) ++ { ++ g_message (_("There was not enough memory to complete the " ++ "operation.")); ++ g_free (buffer); ++ g_free (bw_buffer); ++ return; ++ } + } + + one_row = (gdouble) tile_height / (gdouble) image_height; diff --git a/SOURCES/gimp-CVE-2026-18305.patch b/SOURCES/gimp-CVE-2026-18305.patch new file mode 100644 index 0000000..a2e6d88 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18305.patch @@ -0,0 +1,35 @@ +From 0a45a2b51b877829ef523131b50c0eb2a933b8a1 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 19 Apr 2026 03:16:09 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29406 + +Resolves #16248 +This patch uses g_size_check_mul () and g_try_malloc0 () +to ensure we allocate enough memory for very large TIFF +images when importing RGBA pixels. +--- +--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:11:23.595515987 +0200 ++++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:12:17.205188294 +0200 +@@ -1895,13 +1895,21 @@ load_rgba (TIFF *tif, + guint32 image_height; + guint32 row; + guint32 *buffer; ++ gsize allocation; + + g_printerr ("%s\n", __func__); + + TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &image_width); + TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &image_height); + +- buffer = g_new (uint32_t, image_width * image_height); ++ if (! g_size_checked_mul (&allocation, image_width, image_height) || ++ ! g_size_checked_mul (&allocation, allocation, 4) || ++ (buffer = g_try_malloc0 (allocation)) == NULL) ++ { ++ g_message (_("There was not enough memory to complete the " ++ "operation.")); ++ return; ++ } + + if (! TIFFReadRGBAImage (tif, image_width, image_height, buffer, 0)) + { diff --git a/SOURCES/gimp-CVE-2026-18306.patch b/SOURCES/gimp-CVE-2026-18306.patch new file mode 100644 index 0000000..ec0549e --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18306.patch @@ -0,0 +1,38 @@ +From 76531da9732f38566e5fd8f8f80c837158511ae5 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 18:48:27 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29396 + +Resolves #16249 +This patch adds a check for the SGI read in +bpp being within acceptable ranges (1 or 2). +It also casts pointer arithmetic to gsize +(similar to other areas of the SGI code) +to prevent overflow. +--- +--- a/plug-ins/file-sgi/sgi-lib.c 2026-08-24 14:15:20.184975908 +0200 ++++ b/plug-ins/file-sgi/sgi-lib.c 2026-08-24 14:16:27.320383060 +0200 +@@ -317,6 +317,12 @@ sgiOpenFile(FILE *file, /* I - File to o + + sgip->comp = getc(sgip->file); + sgip->bpp = getc(sgip->file); ++ if (sgip->bpp > 2) ++ { ++ free (sgip); ++ return (NULL); ++ } ++ + getshort(sgip); /* Dimensions */ + sgip->xsize = getshort(sgip); + sgip->ysize = getshort(sgip); +--- a/plug-ins/file-sgi/sgi.c 2026-08-24 14:15:20.187244504 +0200 ++++ b/plug-ins/file-sgi/sgi.c 2026-08-24 14:16:59.125153491 +0200 +@@ -474,7 +474,7 @@ load_image (GFile *file, + pixels[0] = g_new (guchar, ((gsize) tile_height) * sgip->xsize * sgip->bpp * bytes); + + for (i = 1; i < tile_height; i ++) +- pixels[i] = pixels[0] + sgip->xsize * sgip->bpp * bytes * i; ++ pixels[i] = pixels[0] + (((gsize) sgip->xsize) * sgip->bpp * bytes * i); + + rows = g_new (unsigned short *, sgip->zsize); + rows[0] = g_new (unsigned short, ((gsize) sgip->xsize) * sgip->zsize); diff --git a/SOURCES/gimp-CVE-2026-18307.patch b/SOURCES/gimp-CVE-2026-18307.patch new file mode 100644 index 0000000..d438049 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18307.patch @@ -0,0 +1,27 @@ +From bace3e7fd54104fe6b70c1703e9b982a4770811d Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Fri, 5 Jun 2026 18:00:21 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29404 + +Resolves #16250 +It is possible for the samples per pixel value to +be less than the photometric setting. In these +cases, we want to use the SPP value for the +main drawable first, then add additional channels +if they exist. + +Adapted for GIMP 3.0.4. +--- +--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:20:35.250053819 +0200 ++++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:21:14.126312877 +0200 +@@ -1994,8 +1994,8 @@ load_contiguous (TIFF *tif, + src_format = babl_format_n (type, spp); + + /* consistency check */ +- bytes_per_pixel = 0; +- for (i = 0; i <= extra; i++) ++ bytes_per_pixel = babl_format_get_bytes_per_pixel (src_format); ++ for (i = 1; i <= extra; i++) + bytes_per_pixel += babl_format_get_bytes_per_pixel (channel[i].format); + + g_printerr ("bytes_per_pixel: %d, format: %d\n", diff --git a/SOURCES/gimp-CVE-2026-18308.patch b/SOURCES/gimp-CVE-2026-18308.patch new file mode 100644 index 0000000..aa84d17 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-18308.patch @@ -0,0 +1,51 @@ +From d84f8e58f56681a0b4c66129c568cb796725ab9d Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 18:15:41 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29405 + +Resolves #16251 +Adds image size boundary checks for Sketchbook TIFF layers. +Also, verifies that the allocated buffer has not overflowed +before trying to read in data to it. +--- +--- a/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:24:50.062641708 +0200 ++++ b/plug-ins/file-tiff/file-tiff-load.c 2026-08-24 14:25:41.101385919 +0200 +@@ -2407,6 +2407,7 @@ load_sketchbook_layers (TIFF *tif, + gboolean visible = TRUE; + gboolean locked = FALSE; + guint32 *pixels; ++ gsize pixels_size; + guint32 row; + + layer_settings = g_strsplit (alias_sublayer_info, ", ", 10); +@@ -2427,6 +2428,22 @@ load_sketchbook_layers (TIFF *tif, + + TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &layer_width); + TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &layer_height); ++ if (layer_width > GIMP_MAX_IMAGE_SIZE || ++ layer_height > GIMP_MAX_IMAGE_SIZE) ++ { ++ g_message (_("Invalid image dimensions (%u x %u) for " ++ "Sketchbook layer %i. Image may be corrupt."), ++ layer_width, layer_height, i + 1); ++ continue; ++ } ++ ++ if (! g_size_checked_mul (&pixels_size, layer_width, layer_height) || ++ ! g_size_checked_mul (&pixels_size, pixels_size, 4) || ++ (pixels = g_try_malloc0 (pixels_size)) == NULL) ++ { ++ g_free (pixels); ++ continue; ++ } + + if (! TIFFGetField (tif, TIFFTAG_XPOSITION, &x_pos)) + x_pos = 0.0f; +@@ -2441,7 +2458,6 @@ load_sketchbook_layers (TIFF *tif, + gimp_image_insert_layer (image, layer, NULL, -1); + + /* Loading pixel data */ +- pixels = g_new (uint32_t, layer_width * layer_height); + if (! TIFFReadRGBAImage (tif, layer_width, layer_height, pixels, 0)) + { + g_free (pixels); diff --git a/SOURCES/gimp-CVE-2026-59090.patch b/SOURCES/gimp-CVE-2026-59090.patch new file mode 100644 index 0000000..e9e2567 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-59090.patch @@ -0,0 +1,81 @@ +From 612c7e0a5775e7883789022c61f85a1c82c05505 Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Tue, 30 Jun 2026 15:50:17 -0400 +Subject: [PATCH] plug-ins: mitigate issue #16509 + +We received a report by Feng Xue that our PSD loader does not handle +underflow when updating unsigned block_rem, which allows an attacker +to inject data using a specially crafted psd. + +After investigation there were more locations where the same issue +theoreticaly could happen, so we add checks everywhere to make sure +we abort with an error in an underflow situation. + +Adapted for GIMP 3.0.4. +--- +--- a/plug-ins/file-psd/psd-load.c 2026-08-24 13:36:01.524667212 +0200 ++++ b/plug-ins/file-psd/psd-load.c 2026-08-24 13:37:28.342060956 +0200 +@@ -1214,6 +1214,16 @@ read_layer_info (PSDimage *img_a, + + if (! img_a->ibm_pc_format) + block_len = GUINT32_FROM_BE (block_len); ++ ++ if (block_len + 4 > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, block_len); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } ++ + block_rem -= (block_len + 4); + IFDBG(3) g_debug ("Blending ranges size %" G_GSIZE_FORMAT + " (not imported)", block_len); +@@ -1238,6 +1248,15 @@ read_layer_info (PSDimage *img_a, + return NULL; + } + ++ if (read_len > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) read_len); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } ++ + block_rem -= read_len; + IFDBG(3) g_debug ("Offset: %" G_GOFFSET_FORMAT ", Remaining length %" G_GSIZE_FORMAT, + PSD_TELL(input), block_rem); +@@ -1258,6 +1277,14 @@ read_layer_info (PSDimage *img_a, + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } ++ if (header_size > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) header_size); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } + + block_rem -= header_size; + +@@ -1286,6 +1313,15 @@ read_layer_info (PSDimage *img_a, + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } ++ if (res_a.data_len > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, res_a.data_len); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } ++ + block_rem -= res_a.data_len; + IFDBG(3) g_debug ("Remaining length in block: %" G_GSIZE_FORMAT, block_rem); + } diff --git a/SPECS/gimp.spec b/SPECS/gimp.spec index 7012746..a149af2 100644 --- a/SPECS/gimp.spec +++ b/SPECS/gimp.spec @@ -67,7 +67,7 @@ Name: gimp Epoch: 2 Version: 3.0.4 %global rel 4 -Release: %{rel}%{?dist}.9 +Release: %{rel}%{?dist}.10 # https://bugzilla.redhat.com/show_bug.cgi?id=2318369 ExcludeArch: s390x @@ -286,6 +286,15 @@ Patch25: gimp-CVE-2026-66758.patch # https://gitlab.gnome.org/GNOME/gimp/-/commit/691785113a # https://gitlab.gnome.org/GNOME/gimp/-/commit/7dff816fbd Patch26: gimp-CVE-2026-42169.patch +Patch27: gimp-CVE-2026-59090.patch +Patch28: gimp-CVE-2026-18301.patch +Patch29: gimp-CVE-2026-18302.patch +Patch30: gimp-CVE-2026-18303.patch +Patch31: gimp-CVE-2026-18304.patch +Patch32: gimp-CVE-2026-18305.patch +Patch33: gimp-CVE-2026-18306.patch +Patch34: gimp-CVE-2026-18307.patch +Patch35: gimp-CVE-2026-18308.patch # use external help browser directly if help browser plug-in is not built Patch100: gimp-3.0.2-external-help-browser.patch @@ -384,6 +393,15 @@ EOF %patch24 -p1 -b .CVE-2026-66759 %patch25 -p1 -b .CVE-2026-66758 %patch26 -p1 -b .CVE-2026-42169 +%patch27 -p1 -b .CVE-2026-59090 +%patch28 -p1 -b .CVE-2026-18301 +%patch29 -p1 -b .CVE-2026-18302 +%patch30 -p1 -b .CVE-2026-18303 +%patch31 -p1 -b .CVE-2026-18304 +%patch32 -p1 -b .CVE-2026-18305 +%patch33 -p1 -b .CVE-2026-18306 +%patch34 -p1 -b .CVE-2026-18307 +%patch35 -p1 -b .CVE-2026-18308 %patch100 -p1 -b .external-help-browser @@ -699,6 +717,17 @@ done %endif %changelog +* Mon Aug 24 2026 Josef Ridky - 2:3.0.4-4.10 +- fix CVE-2026-59090 +- fix CVE-2026-18301 +- fix CVE-2026-18302 +- fix CVE-2026-18303 +- fix CVE-2026-18304 +- fix CVE-2026-18305 +- fix CVE-2026-18306 +- fix CVE-2026-18307 +- fix CVE-2026-18308 + * Tue Aug 04 2026 RHEL Packaging Agent - 2:3.0.4-4.9 - fix CVE-2026-42169