diff --git a/SOURCES/gimp-CVE-2026-42169.patch b/SOURCES/gimp-CVE-2026-42169.patch new file mode 100644 index 0000000..9242023 --- /dev/null +++ b/SOURCES/gimp-CVE-2026-42169.patch @@ -0,0 +1,73 @@ +From 0ffd587d816dbc73b091b2eba4591d61fe17af95 Mon Sep 17 00:00:00 2001 +From: Gabriele Barbero +Date: Fri, 3 Apr 2026 19:32:16 +0200 +Subject: [PATCH 1/2] plug-ins: validate fcTL frame dimensions... + +...against IHDR bounds in APNG loader + +The pixel buffer is allocated using base image dimensions from the IHDR +chunk, but row write offsets were computed using the per-frame dimensions +from the fcTL chunk with no bounds check. A crafted APNG file with +fcTL.width > IHDR.width or fcTL.height > IHDR.height would cause +out-of-bounds writes into the heap on every row after row 0. + +Reject fcTL frames whose dimensions or offsets extend beyond the base +image dimensions before proceeding with decoding. +--- + plug-ins/common/file-png.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/plug-ins/common/file-png.c b/plug-ins/common/file-png.c +index 0679019be3..a90f52f100 100644 +--- a/plug-ins/common/file-png.c ++++ b/plug-ins/common/file-png.c +@@ -1186,6 +1186,7 @@ load_image (GFile *file, + return (GimpImage *) image; + } + ++ + /* + * 'offsets_dialog ()' - Asks the user about offsets when loading. + */ + +From 16fe5a7cccba25385077c5ee726603dc60c55eb8 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Fri, 10 Apr 2026 02:27:51 +0000 +Subject: [PATCH 2/2] plug-in: Protect against invalid BPP in DDS import + +Resolves #16161 +DDS images have multiple locations for loading BPP values. +It is possible to craft a DDS file with conflicting BPP values +so that not enough space is allocated to read in the image. +This patch adds checks to make sure we use the largest BPP +value to allocate space to prevent this. +--- + plug-ins/file-dds/ddsread.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c +index 85a0e20b85..41285e2505 100644 +--- a/plug-ins/file-dds/ddsread.c ++++ b/plug-ins/file-dds/ddsread.c +@@ -229,13 +229,18 @@ read_dds (GFile *file, + /* If format search was successful, get info needed to parse the file */ + if (load_info.d3d9_format || load_info.dxgi_format) + { ++ gint d3d9_bpp = 0; ++ gint dxgi_bpp = 0; ++ + load_info.read_info = get_format_read_info (load_info.d3d9_format, + load_info.dxgi_format); + +- if ((! hdr.pixelfmt.bpp) && load_info.d3d9_format) +- hdr.pixelfmt.bpp = get_bpp_d3d9 (load_info.d3d9_format); ++ if (load_info.d3d9_format) ++ d3d9_bpp = get_bpp_d3d9 (load_info.d3d9_format); + else if (load_info.dxgi_format) +- hdr.pixelfmt.bpp = get_bpp_dxgi (load_info.dxgi_format); ++ dxgi_bpp = get_bpp_dxgi (load_info.dxgi_format); ++ ++ hdr.pixelfmt.bpp = MAX (MAX (hdr.pixelfmt.bpp, d3d9_bpp), dxgi_bpp); + + /* Unset the FourCC flag as D3D formats will be handled as uncompressed */ + if ((load_info.fmt_flags & DDPF_FOURCC) && load_info.d3d9_format) diff --git a/SOURCES/gimp-CVE-2026-66758.patch b/SOURCES/gimp-CVE-2026-66758.patch new file mode 100644 index 0000000..de966ba --- /dev/null +++ b/SOURCES/gimp-CVE-2026-66758.patch @@ -0,0 +1,129 @@ +From 9061982fec1fc8732253fce8463150acd4a312cc Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 28 Jun 2026 12:58:47 +0000 +Subject: [PATCH 1/2] plug-ins: Mitigate overflow in FITS import + +When allocating memory for importing FITS, it was +possible for the operation to overflow the largest +datatype size, guint32. This patch adds a cast to +gsize for this operation, to reduce the risk of exceeding +the space limit before attempting to allocate. +--- + plug-ins/file-fits/fits.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c +index b4a8dbb433..2cd40f1c3f 100644 +--- a/plug-ins/file-fits/fits.c ++++ b/plug-ins/file-fits/fits.c +@@ -477,9 +477,19 @@ load_image (GFile *file, + /* If RGB FITS image, we need to read in the whole image so we can convert + * the planes format to RGB */ + if (hdu.naxis == 2) +- pixels = (gdouble *) malloc (width * sizeof (gdouble) * channels); ++ pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) * ++ channels); + else +- pixels = (gdouble *) malloc (width * height * sizeof (gdouble) * channels); ++ pixels = (gdouble *) g_try_malloc ((gsize) width * height * ++ sizeof (gdouble) * channels); ++ ++ if (pixels == NULL) ++ { ++ g_set_error (error, G_FILE_ERROR, 0, ++ "Memory could not be allocated."); ++ fits_close_file (ifp, &status); ++ return NULL; ++ } + + if (! image) + { + +From a432acf939384e85c23de67509c9b3f4d4fe43ca Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 8 Jul 2026 19:29:17 +0000 +Subject: [PATCH 2/2] plug-ins: Add more memory checks for FITS imports + +As suggested by Michael Catanzaro and Tristan Madani, +this patch adds calls to g_size_checked_mul () to determine +if the requested size for FITS import memory allocation would +overflow in the two places we allocate. +--- + plug-ins/file-fits/fits.c | 40 ++++++++++++++++++++++++--------------- + 1 file changed, 25 insertions(+), 15 deletions(-) + +diff --git a/plug-ins/file-fits/fits.c b/plug-ins/file-fits/fits.c +index 2cd40f1c3f..273156c5f8 100644 +--- a/plug-ins/file-fits/fits.c ++++ b/plug-ins/file-fits/fits.c +@@ -351,6 +351,7 @@ load_image (GFile *file, + const Babl *type = NULL; + const Babl *format = NULL; + gdouble *pixels; ++ gsize allocate; + gdouble datamin = 1.0E30f; + gdouble datamax = -1.0E30f; + gint channels = 1; +@@ -474,21 +475,18 @@ load_image (GFile *file, + NULL); + } + +- /* If RGB FITS image, we need to read in the whole image so we can convert +- * the planes format to RGB */ +- if (hdu.naxis == 2) +- pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) * +- channels); +- else +- pixels = (gdouble *) g_try_malloc ((gsize) width * height * +- sizeof (gdouble) * channels); +- +- if (pixels == NULL) ++ /* If RGB FITS image, we need to read in the whole image so we can ++ * convert the planes format to RGB */ ++ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) || ++ ! g_size_checked_mul (&allocate, allocate, channels) || ++ (hdu.naxis > 2 && ! g_size_checked_mul (&allocate, allocate, height)) || ++ ! (pixels = (gdouble *) g_try_malloc (allocate))) + { +- g_set_error (error, G_FILE_ERROR, 0, +- "Memory could not be allocated."); ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("There was not enough memory to complete the " ++ "operation.")); + fits_close_file (ifp, &status); +- return NULL; ++ return image; + } + + if (! image) +@@ -559,8 +557,20 @@ load_image (GFile *file, + if (! status) + { + gdouble *temp; ++ gsize allocate; + +- temp = (gdouble *) malloc (width * height * sizeof (gdouble) * channels); ++ if (! g_size_checked_mul (&allocate, width, sizeof (gdouble)) || ++ ! g_size_checked_mul (&allocate, allocate, channels) || ++ ! g_size_checked_mul (&allocate, allocate, height) || ++ ! (temp = (gdouble *) g_try_malloc (allocate))) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("There was not enough memory to complete the " ++ "operation.")); ++ fits_close_file (ifp, &status); ++ g_object_unref (buffer); ++ return image; ++ } + + if (datamin < datamax) + { +@@ -936,7 +946,7 @@ export_fits (GFile *file, + } + + src_offset += width * channelnum; +- offset += width; ++ offset += width; + } + + if (export_type == TFLOAT) diff --git a/SOURCES/gimp-CVE-2026-66759.patch b/SOURCES/gimp-CVE-2026-66759.patch new file mode 100644 index 0000000..6497aad --- /dev/null +++ b/SOURCES/gimp-CVE-2026-66759.patch @@ -0,0 +1,166 @@ +From f484e007afd332f3f1bde204a92cb87a54cbaa3c Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Tue, 7 Jul 2026 15:54:40 +0000 +Subject: [PATCH 1/2] plug-ins: Mitigate OOB write on ICNS mask data + +As reported by Tristan, it is possible to create an ICNS +icon with mask data smaller than the icon size. In this case, +our current code could potentially go out of bounds when writing +from file. This patch adds a check to stop executing the code if +we reach the end of the mask data in the file. +--- + plug-ins/file-icns/file-icns-load.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c +index cd76c710fd..18cd007a39 100644 +--- a/plug-ins/file-icns/file-icns-load.c ++++ b/plug-ins/file-icns/file-icns-load.c +@@ -341,7 +341,7 @@ icns_decompress (guchar *dest, + { + if (out > max) + { +- g_message ("Corrupt icon? compressed run overflows output size."); ++ g_message ("Corrupt icon: compressed run overflows output size."); + return FALSE; + } + dest[out++ * 4 + channel] = val; +@@ -387,10 +387,19 @@ icns_decompress (guchar *dest, + else if (mask) + { + gchar typestring[5]; +- fourcc_get_string (mask->type, typestring); + ++ fourcc_get_string (mask->type, typestring); + for (out = 0; out < max; out++) +- dest[out * 4 + 3] = mask->data[mask->cursor++]; ++ { ++ if (mask->cursor >= mask->size) ++ { ++ g_message ("Corrupt icon mask: uncompressed run overflows input " ++ "size."); ++ return FALSE; ++ } ++ ++ dest[out * 4 + 3] = mask->data[mask->cursor++]; ++ } + } + return TRUE; + } + +From 49092ca0ffacae3ae97caba136139f9734c91ac9 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Tue, 7 Jul 2026 16:49:21 +0000 +Subject: [PATCH 2/2] plug-ins: Correct mask loading in ICNS + +In some instances, we did checks on and pulled bytes +from the icon data instead of the mask data. +This patch corrects the issue. + +In addition, in the unlikely event that GIMP is packaged +on a 32-bit system, we now also guard against an overflow +when allocating IcnsResources. +--- + plug-ins/file-icns/file-icns-load.c | 42 ++++++++++++++++++++++------- + 1 file changed, 32 insertions(+), 10 deletions(-) + +diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c +index 18cd007a39..fcefefa8f8 100644 +--- a/plug-ins/file-icns/file-icns-load.c ++++ b/plug-ins/file-icns/file-icns-load.c +@@ -82,14 +82,17 @@ resource_load (FILE *file) + { + gchar type[5]; + guint32 size; ++ gsize allocation; + + strncpy (type, header.type, 4); + type[4] = '\0'; + size = GUINT32_FROM_BE (header.size); + +- if (! strncmp (header.type, "icns", 4) && size > sizeof (IcnsResourceHeader)) ++ if (! strncmp (header.type, "icns", 4) && ++ size > sizeof (IcnsResourceHeader) && ++ g_size_checked_add (&allocation, sizeof (IcnsResource), size)) + { +- res = (IcnsResource *) g_new (guchar, sizeof (IcnsResource) + size); ++ res = (IcnsResource *) g_new (guchar, allocation); + strncpy (res->type, header.type, 4); + res->type[4] = '\0'; + res->size = size; +@@ -235,8 +238,8 @@ icns_slurp (guchar *dest, + if (out % 8 == 0) + bucket = icns->data[icns->cursor++]; + +- bit = (bucket & 0x80) ? 0 : 255; +- bucket = bucket << 1; ++ bit = (bucket & 0x80) ? 0 : 255; ++ bucket = bucket << 1; + dest[out * 4] = bit; + dest[out * 4 + 1] = bit; + dest[out * 4 + 2] = bit; +@@ -250,8 +253,8 @@ icns_slurp (guchar *dest, + if (out % 2 == 0) + bucket = icns->data[icns->cursor++]; + +- index = 3 * (bucket & 0xf0) >> 4; +- bucket = bucket << 4; ++ index = 3 * (bucket & 0xf0) >> 4; ++ bucket = bucket << 4; + dest[out * 4] = icns_colormap_4[index]; + dest[out * 4 + 1] = icns_colormap_4[index + 1]; + dest[out * 4 + 2] = icns_colormap_4[index + 2]; +@@ -260,7 +263,13 @@ icns_slurp (guchar *dest, + case 8: + for (out = 0; out < max; out++) + { +- index = 3 * icns->data[icns->cursor++]; ++ if (icns->cursor >= icns->size) ++ { ++ g_message ("Invalid or corrupt icns resource file."); ++ return; ++ } ++ ++ index = 3 * icns->data[icns->cursor++]; + dest[out * 4] = icns_colormap_8[index]; + dest[out * 4 + 1] = icns_colormap_8[index + 1]; + dest[out * 4 + 2] = icns_colormap_8[index + 2]; +@@ -270,13 +279,26 @@ icns_slurp (guchar *dest, + case 32: + for (out = 0; out < max; out++) + { ++ if (icns->size < 4 || icns->cursor > icns->size - 4) ++ { ++ g_message ("Invalid or corrupt icns resource file."); ++ return; ++ } ++ + dest[out * 4] = icns->data[icns->cursor++]; + dest[out * 4 + 1] = icns->data[icns->cursor++]; + dest[out * 4 + 2] = icns->data[icns->cursor++]; + /* Throw away alpha, use the mask */ + icns->cursor++; ++ ++ if (mask && mask->cursor >= mask->size) ++ { ++ g_message ("Invalid or corrupt icns resource file."); ++ return; ++ } ++ + if (mask) +- dest[out * 4 + 3] = icns->data[mask->cursor++]; ++ dest[out * 4 + 3] = mask->data[mask->cursor++]; + else + dest[out * 4 + 3] = 255; + } +@@ -292,8 +314,8 @@ icns_slurp (guchar *dest, + if (out % 8 == 0) + bucket = mask->data[mask->cursor++]; + +- bit = (bucket & 0x80) ? 255 : 0; +- bucket = bucket << 1; ++ bit = (bucket & 0x80) ? 255 : 0; ++ bucket = bucket << 1; + dest[out * 4 + 3] = bit; + } + } diff --git a/SPECS/gimp.spec b/SPECS/gimp.spec index 1d60f77..7012746 100644 --- a/SPECS/gimp.spec +++ b/SPECS/gimp.spec @@ -67,7 +67,7 @@ Name: gimp Epoch: 2 Version: 3.0.4 %global rel 4 -Release: %{rel}%{?dist}.7 +Release: %{rel}%{?dist}.9 # https://bugzilla.redhat.com/show_bug.cgi?id=2318369 ExcludeArch: s390x @@ -277,6 +277,15 @@ Patch21: gimp-CVE-2026-58379.patch Patch22: gimp-CVE-2026-58384.patch # https://gitlab.gnome.org/GNOME/gimp/-/commit/83699817 Patch23: gimp-CVE-2026-58380.patch +# https://gitlab.gnome.org/GNOME/gimp/-/commit/abb3129a8ecb +# https://gitlab.gnome.org/GNOME/gimp/-/commit/41ef331896882 +Patch24: gimp-CVE-2026-66759.patch +# https://gitlab.gnome.org/GNOME/gimp/-/commit/b01d06315352b56928625e480dd22b3876721e2c +# https://gitlab.gnome.org/GNOME/gimp/-/commit/bcde5da5e350c9c6100a579ba2b762e007c78150 +Patch25: gimp-CVE-2026-66758.patch +# https://gitlab.gnome.org/GNOME/gimp/-/commit/691785113a +# https://gitlab.gnome.org/GNOME/gimp/-/commit/7dff816fbd +Patch26: gimp-CVE-2026-42169.patch # use external help browser directly if help browser plug-in is not built Patch100: gimp-3.0.2-external-help-browser.patch @@ -372,6 +381,9 @@ EOF %patch21 -p1 -b .CVE-2026-58379 %patch22 -p1 -b .CVE-2026-58384 %patch23 -p1 -b .CVE-2026-58380 +%patch24 -p1 -b .CVE-2026-66759 +%patch25 -p1 -b .CVE-2026-66758 +%patch26 -p1 -b .CVE-2026-42169 %patch100 -p1 -b .external-help-browser @@ -687,6 +699,17 @@ done %endif %changelog +* Tue Aug 04 2026 RHEL Packaging Agent - 2:3.0.4-4.9 +- fix CVE-2026-42169 + +* Tue Jul 28 2026 RHEL Packaging Agent - 2:3.0.4-4.8 +- fix CVE-2026-66758 +- fix CVE-2026-66759 + +* Mon Jul 13 2026 RHEL Packaging Agent - 2:3.0.4-4.7 +- fix CVE-2026-58380 +- Resolves: RHEL-192383 + * Fri Jul 10 2026 RHEL Packaging Agent - 2:3.0.4-4.6 - fix CVE-2026-58384 - Resolves: RHEL-192536