diff --git a/gimp-3.0.2-CVE-2025-14422.patch b/gimp-3.0.2-CVE-2025-14422.patch new file mode 100644 index 0000000000000000000000000000000000000000..c7d43ef1eae463912c18e24f5da29129f9ca15cb --- /dev/null +++ b/gimp-3.0.2-CVE-2025-14422.patch @@ -0,0 +1,59 @@ +From 4ff2d773d58064e6130495de498e440f4a6d5edb Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 23 Nov 2025 16:43:51 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-28273 + +Resolves #15286 +Adds a check to the memory allocation +in pnm_load_raw () with g_size_checked_mul () +to see if the size would go out of bounds. +If so, we don't try to allocate and load the +image. +--- + plug-ins/common/file-pnm.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) +diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c +index 32a33a4..9d349e9 100644 +--- a/plug-ins/common/file-pnm.c ++++ b/plug-ins/common/file-pnm.c +@@ -674,7 +674,7 @@ load_image (GFile *file, + GError **error) + { + GInputStream *input; +- GeglBuffer *buffer; ++ GeglBuffer *buffer = NULL; + GimpImage * volatile image = NULL; + GimpLayer *layer; + char buf[BUFLEN + 4]; /* buffer for random things like scanning */ +@@ -708,6 +708,9 @@ load_image (GFile *file, + g_object_unref (input); + g_free (pnminfo); + ++ if (buffer) ++ g_object_unref (buffer); ++ + if (image) + gimp_image_delete (image); + +@@ -1060,6 +1063,7 @@ pnm_load_raw (PNMScanner *scan, + const Babl *format = NULL; + gint bpc; + guchar *data, *d; ++ gsize data_size; + gushort *s; + gint x, y, i; + gint start, end, scanlines; +@@ -1070,7 +1074,12 @@ pnm_load_raw (PNMScanner *scan, + bpc = 1; + + /* No overflow as long as gimp_tile_height() < 1365 = 2^(31 - 18) / 6 */ +- data = g_new (guchar, gimp_tile_height () * info->xres * info->np * bpc); ++ if (! g_size_checked_mul (&data_size, gimp_tile_height (), info->xres) || ++ ! g_size_checked_mul (&data_size, data_size, info->np) || ++ ! g_size_checked_mul (&data_size, data_size, bpc)) ++ CHECK_FOR_ERROR (FALSE, info->jmpbuf, _("Unsupported maximum value.")); ++ ++ data = g_new (guchar, data_size); + + input = pnmscanner_input (scan); + diff --git a/gimp-3.0.2-CVE-2025-14423.patch b/gimp-3.0.2-CVE-2025-14423.patch new file mode 100644 index 0000000000000000000000000000000000000000..fb6e17571f660e879a723c7dc95e4623deb7dcb8 --- /dev/null +++ b/gimp-3.0.2-CVE-2025-14423.patch @@ -0,0 +1,99 @@ +From 481cdbbb97746be1145ec3a633c567a68633c521 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 23 Nov 2025 04:22:49 +0000 +Subject: [PATCH] plug-ins: Fix ZDI-CAN-28311 + +Resolves #15292 +The IFF specification states that EHB format images +have exactly 32 colors in their palette. However, it +is possible for images in the wild to place an incorrect +palette size. This patch checks for this, and either limits +the palette size or breaks accordingly. +--- + plug-ins/common/file-iff.c | 32 ++++++++++++++++++++++---------- + 1 file changed, 22 insertions(+), 10 deletions(-) +diff --git a/plug-ins/common/file-iff.c b/plug-ins/common/file-iff.c +index 6c14189..e7a3d39 100644 +--- a/plug-ins/common/file-iff.c ++++ b/plug-ins/common/file-iff.c +@@ -335,7 +335,7 @@ load_image (GFile *file, + width = bitMapHeader->w; + height = bitMapHeader->h; + nPlanes = bitMapHeader->nPlanes; +- row_length = (width + 15) / 16; ++ row_length = ((width + 15) / 16) * 2; + pixel_size = nPlanes / 8; + aspect_x = bitMapHeader->xAspect; + aspect_y = bitMapHeader->yAspect; +@@ -366,6 +366,18 @@ load_image (GFile *file, + { + /* EHB mode adds 32 more colors. Each are half the RGB values + * of the first 32 colors */ ++ if (palette_size < 32) ++ { ++ g_set_error (error, G_FILE_ERROR, ++ g_file_error_from_errno (errno), ++ _("Invalid ILBM colormap size")); ++ return NULL; ++ } ++ else if (palette_size > 32) ++ { ++ palette_size = 32; ++ } ++ + for (gint j = 0; j < palette_size * 2; j++) + { + gint offset_index = j + 32; +@@ -377,7 +389,7 @@ load_image (GFile *file, + gimp_cmap[offset_index * 3 + 2] = + colorMap->colorRegister[j].blue / 2; + } +- /* EHB mode always has 64 colors */ ++ /* EHB mode always has 64 colors in total */ + palette_size = 64; + } + } +@@ -438,7 +450,7 @@ load_image (GFile *file, + { + guchar *pixel_row; + +- pixel_row = g_malloc (width * pixel_size * sizeof (guchar)); ++ pixel_row = g_malloc0 (width * pixel_size); + + /* PBM uses one byte per pixel index */ + if (ILBM_imageIsPBM (true_image)) +@@ -450,7 +462,7 @@ load_image (GFile *file, + else + deleave_rgb_row (bitplanes, pixel_row, width, nPlanes, pixel_size); + +- bitplanes += (row_length * 2 * nPlanes); ++ bitplanes += (row_length * nPlanes); + + gegl_buffer_set (buffer, GEGL_RECTANGLE (0, y_height, width, 1), 0, + NULL, pixel_row, GEGL_AUTO_ROWSTRIDE); +@@ -519,7 +531,7 @@ deleave_ham_row (const guchar *gimp_cmap, + /* Deleave rows */ + for (gint i = 0; i < row_length; i++) + { +- for (gint j = 0; j < 8; j++) ++ for (gint j = 0; j < nPlanes; j++) + { + guint8 bitmask = (1 << (8 - j)) - (1 << (7 - j)); + guint8 control = 0; +@@ -581,11 +593,11 @@ deleave_ham_row (const guchar *gimp_cmap, + } + + static void +-deleave_rgb_row (IFF_UByte *bitplanes, +- guchar *pixel_row, +- gint width, +- gint nPlanes, +- gint pixel_size) ++deleave_rgb_row (IFF_UByte *bitplanes, ++ guchar *pixel_row, ++ gint width, ++ gint nPlanes, ++ gint pixel_size) + { + gint row_length = ((width + 15) / 16) * 2; + gint current_pixel = 0; diff --git a/gimp-3.0.2-CVE-2025-14424.patch b/gimp-3.0.2-CVE-2025-14424.patch new file mode 100644 index 0000000000000000000000000000000000000000..0bcf710029cdf1510894d1db17a0251880cd6165 --- /dev/null +++ b/gimp-3.0.2-CVE-2025-14424.patch @@ -0,0 +1,27 @@ +From 5cc55d078b7fba995cef77d195fac325ee288ddd Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Thu, 13 Nov 2025 18:26:51 -0500 +Subject: [PATCH] app: fix #15288 crash when loading malformed xcf + +ZDI-CAN-28376 vulnerability + +Add extra tests to not crash on a NULL g_class. +--- + app/core/gimpitemlist.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) +diff --git a/app/core/gimpitemlist.c b/app/core/gimpitemlist.c +index e40ed3c..de84cf1 100644 +--- a/app/core/gimpitemlist.c ++++ b/app/core/gimpitemlist.c +@@ -343,7 +343,10 @@ gimp_item_list_named_new (GimpImage *image, + g_return_val_if_fail (GIMP_IS_IMAGE (image), NULL); + + for (iter = items; iter; iter = iter->next) +- g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL); ++ { ++ g_return_val_if_fail (iter->data && ((GTypeInstance*) (iter->data))->g_class, NULL); ++ g_return_val_if_fail (g_type_is_a (G_OBJECT_TYPE (iter->data), item_type), NULL); ++ } + + if (! items) + { diff --git a/gimp-3.0.2-CVE-2025-14425.patch b/gimp-3.0.2-CVE-2025-14425.patch new file mode 100644 index 0000000000000000000000000000000000000000..4fbc9fd69bb1d35c079132f4e89d482a12eb01cf --- /dev/null +++ b/gimp-3.0.2-CVE-2025-14425.patch @@ -0,0 +1,68 @@ +From cd1c88a0364ad1444c06536731972a99bd8643fd Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 12 Nov 2025 13:25:44 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-28248 for JP2 images + +Resolves #15285 +Per the report, it's possible to exceed the size of the pixel buffer +with a high precision_scaled value, as we size it to the width * bpp. +This patch includes precision_scaled in the allocation calculation. +It also adds a g_size_checked_mul () check to ensure there's no +overflow, and moves the pixel and buffer memory freeing to occur +in the out section so that it always runs even on failure. +Adapted-by: PkgAgent (file-jp2.c -> file-jp2-load.c split in gimp 3.0.2) +--- + plug-ins/common/file-jp2-load.c | 22 +++++++++++++++----- + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/plug-ins/common/file-jp2-load.c b/plug-ins/common/file-jp2-load.c +index eddc971..1475fcc 100644 +--- a/plug-ins/common/file-jp2-load.c ++++ b/plug-ins/common/file-jp2-load.c +@@ -1032,9 +1032,10 @@ load_image (GimpProcedure *procedure, + gint width; + gint height; + gint num_components; +- GeglBuffer *buffer; ++ GeglBuffer *buffer = NULL; + gint i, j, k, it; +- guchar *pixels; ++ guchar *pixels = NULL; ++ gsize pixels_size; + const Babl *file_format; + gint bpp; + GimpPrecision image_precision; +@@ -1283,7 +1284,15 @@ load_image (GimpProcedure *procedure, + bpp = babl_format_get_bytes_per_pixel (file_format); + + buffer = gimp_drawable_get_buffer (GIMP_DRAWABLE (layer)); +- pixels = g_new0 (guchar, width * bpp); ++ ++ if (! g_size_checked_mul (&pixels_size, width, (bpp * (precision_scaled / 8)))) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("Defined row size is too large in JP2 image '%s'."), ++ gimp_file_get_utf8_name (file)); ++ goto out; ++ } ++ pixels = g_new0 (guchar, pixels_size); + + for (i = 0; i < height; i++) + { +@@ -1310,12 +1319,13 @@ load_image (GimpProcedure *procedure, + file_format, pixels, GEGL_AUTO_ROWSTRIDE); + } + +- g_free (pixels); +- +- g_object_unref (buffer); + gimp_progress_update (1.0); + + out: ++ if (pixels) ++ g_free (pixels); ++ if (buffer) ++ g_object_unref (buffer); + if (profile) + g_object_unref (profile); + if (image) diff --git a/gimp-3.0.2-CVE-2026-0797-1.patch b/gimp-3.0.2-CVE-2026-0797-1.patch new file mode 100644 index 0000000000000000000000000000000000000000..0d3760ca6f168e3c4f0c8e98ee21fa3f5bc5b43d --- /dev/null +++ b/gimp-3.0.2-CVE-2026-0797-1.patch @@ -0,0 +1,86 @@ +From c54bf22acb04b83ae38ed50add58f300e898dd81 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Fri, 26 Dec 2025 15:49:45 +0000 +Subject: [PATCH] plug-ins: Add more fread () checks in ICO loading + +Resolves #15555 + +This patch adds some guards for ico_read_int8 (), +which was used for loading palettes and maps +without verifying that it returned the same number +of bytes as what it tried to read in. +--- + plug-ins/file-ico/ico-load.c | 33 ++++++++++++++++++++++++++------- + 1 file changed, 26 insertions(+), 7 deletions(-) +diff --git a/plug-ins/file-ico/ico-load.c b/plug-ins/file-ico/ico-load.c +index 9a22299..6415229 100644 +--- a/plug-ins/file-ico/ico-load.c ++++ b/plug-ins/file-ico/ico-load.c +@@ -69,7 +69,9 @@ ico_read_int32 (FILE *fp, + total = count; + if (count > 0) + { +- ico_read_int8 (fp, (guint8 *) data, count * 4); ++ if (ico_read_int8 (fp, (guint8 *) data, count * 4) != (count * 4)) ++ return FALSE; ++ + for (i = 0; i < count; i++) + data[i] = GUINT32_FROM_LE (data[i]); + } +@@ -88,7 +90,9 @@ ico_read_int16 (FILE *fp, + total = count; + if (count > 0) + { +- ico_read_int8 (fp, (guint8 *) data, count * 2); ++ if (ico_read_int8 (fp, (guint8 *) data, count * 2) != (count * 2)) ++ return FALSE; ++ + for (i = 0; i < count; i++) + data[i] = GUINT16_FROM_LE (data[i]); + } +@@ -109,8 +113,8 @@ ico_read_int8 (FILE *fp, + while (count > 0) + { + bytes = fread ((gchar *) data, sizeof (gchar), count, fp); +- if (bytes <= 0) /* something bad happened */ +- break; ++ if (bytes != count) /* something bad happened */ ++ return -1; + + count -= bytes; + data += bytes; +@@ -485,16 +489,31 @@ ico_read_icon (FILE *fp, + data.used_clrs, data.bpp)); + + palette = g_new0 (guint32, data.used_clrs); +- ico_read_int8 (fp, (guint8 *) palette, data.used_clrs * 4); ++ if (ico_read_int8 (fp, ++ (guint8 *) palette, ++ data.used_clrs * 4) != (data.used_clrs * 4)) ++ { ++ D(("skipping image: too large\n")); ++ return FALSE; ++ } ++ + } + + xor_map = ico_alloc_map (w, h, data.bpp, &length); +- ico_read_int8 (fp, xor_map, length); ++ if (ico_read_int8 (fp, xor_map, length) != length) ++ { ++ D(("skipping image: too large\n")); ++ return FALSE; ++ } + D((" length of xor_map: %i\n", length)); + + /* Read in and_map. It's padded out to 32 bits per line: */ + and_map = ico_alloc_map (w, h, 1, &length); +- ico_read_int8 (fp, and_map, length); ++ if (! ico_read_int8 (fp, and_map, length) != length) ++ { ++ D(("skipping image: too large\n")); ++ return FALSE; ++ } + D((" length of and_map: %i\n", length)); + + dest_vec = (guint32 *) buf; diff --git a/gimp-3.0.2-CVE-2026-0797-2.patch b/gimp-3.0.2-CVE-2026-0797-2.patch new file mode 100644 index 0000000000000000000000000000000000000000..6dbf1e2f643afee240723ac317a2a64de65637a1 --- /dev/null +++ b/gimp-3.0.2-CVE-2026-0797-2.patch @@ -0,0 +1,55 @@ +From 905ce4b48782c5e71c79714b7ba7f6ebe4d0329d Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 27 Dec 2025 05:24:03 +0000 +Subject: [PATCH] plug-ins: Additional fread () checks in ICO plug-in + +A continuation of c54bf22a that adds checks to the +initial header loading as well, to prevent reading +beyond the file size. +--- + plug-ins/file-ico/ico-load.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) +diff --git a/plug-ins/file-ico/ico-load.c b/plug-ins/file-ico/ico-load.c +index 6415229..c2ca957 100644 +--- a/plug-ins/file-ico/ico-load.c ++++ b/plug-ins/file-ico/ico-load.c +@@ -437,16 +437,20 @@ ico_read_icon (FILE *fp, + palette = NULL; + + data.header_size = header_size; +- ico_read_int32 (fp, &data.width, 1); +- ico_read_int32 (fp, &data.height, 1); +- ico_read_int16 (fp, &data.planes, 1); +- ico_read_int16 (fp, &data.bpp, 1); +- ico_read_int32 (fp, &data.compression, 1); +- ico_read_int32 (fp, &data.image_size, 1); +- ico_read_int32 (fp, &data.x_res, 1); +- ico_read_int32 (fp, &data.y_res, 1); +- ico_read_int32 (fp, &data.used_clrs, 1); +- ico_read_int32 (fp, &data.important_clrs, 1); ++ if (ico_read_int32 (fp, &data.width, 1) != 4 || ++ ico_read_int32 (fp, &data.height, 1) != 4 || ++ ico_read_int16 (fp, &data.planes, 1) != 2 || ++ ico_read_int16 (fp, &data.bpp, 1) != 2 || ++ ico_read_int32 (fp, &data.compression, 1) != 4 || ++ ico_read_int32 (fp, &data.image_size, 1) != 4 || ++ ico_read_int32 (fp, &data.x_res, 1) != 4 || ++ ico_read_int32 (fp, &data.y_res, 1) != 4 || ++ ico_read_int32 (fp, &data.used_clrs, 1) != 4 || ++ ico_read_int32 (fp, &data.important_clrs, 1) != 4) ++ { ++ D(("skipping image: invalid header\n")); ++ return FALSE; ++ } + + D((" header size %i, " + "w %i, h %i, planes %i, size %i, bpp %i, used %i, imp %i.\n", +@@ -509,7 +513,7 @@ ico_read_icon (FILE *fp, + + /* Read in and_map. It's padded out to 32 bits per line: */ + and_map = ico_alloc_map (w, h, 1, &length); +- if (! ico_read_int8 (fp, and_map, length) != length) ++ if (ico_read_int8 (fp, and_map, length) != length) + { + D(("skipping image: too large\n")); + return FALSE; diff --git a/gimp-3.0.2-CVE-2026-2044.patch b/gimp-3.0.2-CVE-2026-2044.patch new file mode 100644 index 0000000000000000000000000000000000000000..ab41f1eaf9aae4023ec48ca6562bef7e6f1dbb0c --- /dev/null +++ b/gimp-3.0.2-CVE-2026-2044.patch @@ -0,0 +1,23 @@ +From 112a5e038f0646eae5ae314988ec074433d2b365 Mon Sep 17 00:00:00 2001 +From: Gabriele Barbero +Date: Fri, 5 Dec 2025 19:13:01 +0100 +Subject: [PATCH] ZDI-CAN-28158: use g_malloc0 instead of g_malloc + +To avoid accessing uninitialized memory, replace calls to g_malloc with +g_malloc0 which initializes the allocated memory to zero. +--- + plug-ins/common/file-pnm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) +diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c +index 9d349e9..65619be 100644 +--- a/plug-ins/common/file-pnm.c ++++ b/plug-ins/common/file-pnm.c +@@ -693,7 +693,7 @@ load_image (GFile *file, + return NULL; + + /* allocate the necessary structures */ +- pnminfo = g_new (PNMInfo, 1); ++ pnminfo = g_new0 (PNMInfo, 1); + + pnminfo->tupltype = NULL; + diff --git a/gimp-3.0.2-CVE-2026-2045.patch b/gimp-3.0.2-CVE-2026-2045.patch new file mode 100644 index 0000000000000000000000000000000000000000..43cc1c3e1d84f14d4169e9da7cf951b044ecbe09 --- /dev/null +++ b/gimp-3.0.2-CVE-2026-2045.patch @@ -0,0 +1,32 @@ +From 68b27dfb1cbd9b3f22d7fa624dbab8647ee5f275 Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Thu, 15 Jan 2026 10:12:07 -0500 +Subject: [PATCH] plug-ins: fix #15293 security issue ZDI-CAN-28265 + +Just like we did in commit 4eb106f2bff2d9b8e518aa455a884c6f38d70c6a +we need to make sure that the offset in the colormap is valid before +using it, before using it to compute the RGB values. +--- + plug-ins/common/file-xwd.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index 1490779..531aede 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -1701,7 +1701,15 @@ load_xwd_f2_d16_b16 (GFile *file, + + for (j = 0; j < ncols; j++) + { +- cm = ColorMap + xwdcolmap[j].l_pixel * 3; ++ goffset offset = xwdcolmap[j].l_pixel * 3; ++ ++ if (offset+2 >= maxval) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("Invalid colormap offset. Possibly corrupt image.")); ++ return NULL; ++ } ++ cm = ColorMap + offset; + *(cm++) = (xwdcolmap[j].l_red >> 8); + *(cm++) = (xwdcolmap[j].l_green >> 8); + *cm = (xwdcolmap[j].l_blue >> 8); diff --git a/gimp-3.0.2-CVE-2026-2047.patch b/gimp-3.0.2-CVE-2026-2047.patch new file mode 100644 index 0000000000000000000000000000000000000000..2be7402c58bbec70357b7daa7faa2693b33e1935 --- /dev/null +++ b/gimp-3.0.2-CVE-2026-2047.patch @@ -0,0 +1,158 @@ +From dd2faac351f1ff2588529fedc606e6a5f815577c Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 17 Jan 2026 16:59:17 +0000 +Subject: [PATCH] plug-ins: Resolve ZDI-CAN-28530 for ICNS load + +Our ICNS importer did not verify that the ICNS resource +data size was defined as larger than 0. Therefore, it +was possible to create a malicious file that would infinitely +load since the file cursor would not advance. This patch +adds a check for the icon size being 0, and stops the loop +if this is encountered. + +Additionally, there is no header defined limit for the number of +icons in an ICNS file. This patch switches from using a hardcoded +256 icon limit to using GLists to dynamically add icons as we read +them in. +--- + plug-ins/file-icns/file-icns-load.c | 59 ++++++++++++++++++++--------- + 1 file changed, 42 insertions(+), 17 deletions(-) +diff --git a/plug-ins/file-icns/file-icns-load.c b/plug-ins/file-icns/file-icns-load.c +index c8f16fe..cd76c71 100644 +--- a/plug-ins/file-icns/file-icns-load.c ++++ b/plug-ins/file-icns/file-icns-load.c +@@ -40,7 +40,7 @@ + + IcnsResource * resource_load (FILE *file); + +-IcnsResource * resource_find (IcnsResource *list, ++IcnsResource * resource_find (GList *resources, + gchar *type, + gint max); + +@@ -118,14 +118,18 @@ resource_load (FILE *file) + } + + IcnsResource * +-resource_find (IcnsResource *list, ++resource_find (GList *resources, + gchar *type, + gint max) + { +- for (gint i = 0; i < max; i++) ++ GList *list; ++ ++ for (list = resources; list; list = g_list_next (list)) + { +- if (! strncmp (list[i].type, type, 4)) +- return &list[i]; ++ IcnsResource *res = list->data; ++ ++ if (! strncmp (res->type, type, 4)) ++ return res; + } + return NULL; + } +@@ -145,10 +149,14 @@ resource_get_next (IcnsResource *icns, + res->cursor = sizeof (IcnsResourceHeader); + res->data = &(icns->data[icns->cursor]); + ++ if (! res->size) ++ return FALSE; ++ + icns->cursor += res->size; + if (icns->cursor > icns->size) + { + gchar typestring[5]; ++ + fourcc_get_string (icns->type, typestring); + g_message ("icns resource_get_next: resource too big! type '%s', size %u\n", + typestring, icns->size); +@@ -162,18 +170,25 @@ GimpImage * + icns_load (IcnsResource *icns, + GFile *file) + { +- IcnsResource *resources; ++ GList *resources; ++ IcnsResource *resource; + guint nResources; + gfloat current_resources = 0; + GimpImage *image; + +- resources = g_new (IcnsResource, 256); ++ resources = NULL; ++ resource = g_new (IcnsResource, 1); + + /* Largest .icns icon is 1024 x 1024 */ + image = gimp_image_new (1024, 1024, GIMP_RGB); + + nResources = 0; +- while (resource_get_next (icns, &resources[nResources++])) {} ++ while (resource_get_next (icns, resource)) ++ { ++ resources = g_list_append (resources, resource); ++ ++ resource = g_new (IcnsResource, 1); ++ } + + for (gint i = 0; iconTypes[i].type; i++) + { +@@ -192,7 +207,8 @@ icns_load (IcnsResource *icns, + } + + gimp_image_resize_to_layers (image); +- g_free (resources); ++ g_list_free_full (resources, g_free); ++ g_free (resource); + return image; + } + +@@ -585,7 +601,8 @@ icns_load_thumbnail_image (GFile *file, + FILE *fp; + GimpImage *image = NULL; + IcnsResource *icns; +- IcnsResource *resources; ++ GList *resources; ++ IcnsResource *resource; + IcnsResource *mask = NULL; + guint i; + gint match = -1; +@@ -610,15 +627,22 @@ icns_load_thumbnail_image (GFile *file, + fclose (fp); + + if (! icns) +- { +- g_message ("Invalid or corrupt icns resource file."); +- return NULL; +- } ++ { ++ g_message ("Invalid or corrupt icns resource file."); ++ return NULL; ++ } + + image = gimp_image_new (1024, 1024, GIMP_RGB); + +- resources = g_new (IcnsResource, 256); +- while (resource_get_next (icns, &resources[nResources++])) {} ++ resources = NULL; ++ resource = g_new (IcnsResource, 1); ++ ++ while (resource_get_next (icns, resource)) ++ { ++ resources = g_list_append (resources, resource); ++ ++ resource = g_new (IcnsResource, 1); ++ } + + *width = 0; + *height = 0; +@@ -671,7 +695,8 @@ icns_load_thumbnail_image (GFile *file, + return NULL; + } + +- g_free (resources); ++ g_list_free_full (resources, g_free); ++ g_free (resource); + + gimp_progress_update (1.0); + diff --git a/gimp-3.0.2-CVE-2026-2048.patch b/gimp-3.0.2-CVE-2026-2048.patch new file mode 100644 index 0000000000000000000000000000000000000000..9aa18b8cdc8c2c682dc66bcc0a034901c2dd303b --- /dev/null +++ b/gimp-3.0.2-CVE-2026-2048.patch @@ -0,0 +1,83 @@ +From 57712677007793118388c5be6fb8231f22a2b341 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 31 Dec 2025 14:45:15 +0000 +Subject: [PATCH] plug-ins: Add OoB check for loading XWD + +Resolves #15554 +This patch adds a check for if our pointer arithmetic +exceeds the memory allocated for the dest array. If so, +we throw an error rather than access memory outside +the bounds. +--- + plug-ins/common/file-xwd.c | 31 ++++++++++++++++++++++++++++--- + 1 file changed, 28 insertions(+), 3 deletions(-) +diff --git a/plug-ins/common/file-xwd.c b/plug-ins/common/file-xwd.c +index 8d01339..1490779 100644 +--- a/plug-ins/common/file-xwd.c ++++ b/plug-ins/common/file-xwd.c +@@ -2230,6 +2230,7 @@ load_xwd_f1_d24_b1 (GFile *file, + guint32 redmask, greenmask, bluemask; + guint redshift, greenshift, blueshift; + guint32 g; ++ guint32 maxval; + guchar redmap[256], greenmap[256], bluemap[256]; + guchar bit_reverse[256]; + guchar *xwddata, *xwdin, *data; +@@ -2321,7 +2322,8 @@ load_xwd_f1_d24_b1 (GFile *file, + &layer, &buffer); + + tile_height = gimp_tile_height (); +- data = g_malloc (tile_height * width * bytes_per_pixel); ++ data = g_malloc (tile_height * width * bytes_per_pixel); ++ maxval = tile_height * width * bytes_per_pixel; + + ncols = xwdhdr->l_colormap_entries; + if (xwdhdr->l_ncolors < ncols) +@@ -2346,6 +2348,8 @@ load_xwd_f1_d24_b1 (GFile *file, + + for (tile_start = 0; tile_start < height; tile_start += tile_height) + { ++ guint current_dest = 0; ++ + memset (data, 0, width*tile_height*bytes_per_pixel); + + tile_end = tile_start + tile_height - 1; +@@ -2373,7 +2377,18 @@ load_xwd_f1_d24_b1 (GFile *file, + else /* 3 bytes per pixel */ + { + fromright = xwdhdr->l_pixmap_depth-1-plane; +- dest += 2 - fromright/8; ++ ++ current_dest += 2 - fromright / 8; ++ if (current_dest < maxval) ++ { ++ dest += 2 - fromright / 8; ++ } ++ else ++ { ++ err = 1; ++ break; ++ } ++ + outmask = (1 << (fromright % 8)); + } + +@@ -2428,7 +2443,17 @@ load_xwd_f1_d24_b1 (GFile *file, + + if (g & inmask) + *dest |= outmask; +- dest += bytes_per_pixel; ++ ++ current_dest += bytes_per_pixel; ++ if (current_dest < maxval) ++ { ++ dest += bytes_per_pixel; ++ } ++ else ++ { ++ err = 1; ++ break; ++ } + + inmask >>= 1; + } diff --git a/gimp-3.0.2-CVE-2026-58380.patch b/gimp-3.0.2-CVE-2026-58380.patch new file mode 100644 index 0000000000000000000000000000000000000000..e5d5620b6f170012c01dfc9b08b416c0e035f363 --- /dev/null +++ b/gimp-3.0.2-CVE-2026-58380.patch @@ -0,0 +1,27 @@ +From 8369981756fc2742226b79296fd1886156001d94 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 11 Apr 2026 14:33:42 +0000 +Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken + +Resolves #16206 +pnmscanner_gettoken () in file-pnm assumes that the +buffer it receives is larger than its bufsize parameter. +In almost all cases this is true, except in pnm_load_ascii (). +This patch adds the + 4 that is used everywhere else to ensure +we don't have an issue with buffer overflow. +--- + plug-ins/common/file-pnm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) +diff --git a/plug-ins/common/file-pnm.c b/plug-ins/common/file-pnm.c +index 65619be..81d73c1 100644 +--- a/plug-ins/common/file-pnm.c ++++ b/plug-ins/common/file-pnm.c +@@ -958,7 +958,7 @@ pnm_load_ascii (PNMScanner *scan, + gint x, y, i, b; + gint start, end, scanlines; + gint np; +- gchar buf[BUFLEN]; ++ gchar buf[BUFLEN + 4]; + gboolean aborted = FALSE; + + np = (info->np) ? (info->np) : 1; diff --git a/gimp.spec b/gimp.spec index 6d93181bccdefaff21e0b3f2c7994ae0be602886..eb6a4b5407534418654d0d1e2954fe9e84a422a7 100644 --- a/gimp.spec +++ b/gimp.spec @@ -8,7 +8,7 @@ Summary: GNU Image Manipulation Program Name: gimp Version: 3.0.2 -Release: 4%{?dist} +Release: 5%{?dist} %global major %(ver=%{version}; echo ${ver%%%%.*}) %global minor %(ver=%{version}; ver=${ver#%major.}; echo ${ver%%%%.*}) @@ -27,6 +27,17 @@ Patch0005: gimp-3.0.2-CVE-2025-10922.patch Patch0006: gimp-3.0.2-CVE-2025-10924.patch Patch0007: gimp-3.0.2-CVE-2025-10920.patch Patch0008: gimp-3.0.2-CVE-2025-10923.patch +Patch0009: gimp-3.0.2-CVE-2025-14422.patch +Patch0010: gimp-3.0.2-CVE-2025-14423.patch +Patch0011: gimp-3.0.2-CVE-2025-14424.patch +Patch0012: gimp-3.0.2-CVE-2025-14425.patch +Patch0013: gimp-3.0.2-CVE-2026-0797-1.patch +Patch0014: gimp-3.0.2-CVE-2026-0797-2.patch +Patch0015: gimp-3.0.2-CVE-2026-2044.patch +Patch0016: gimp-3.0.2-CVE-2026-2045.patch +Patch0017: gimp-3.0.2-CVE-2026-2047.patch +Patch0018: gimp-3.0.2-CVE-2026-2048.patch +Patch0019: gimp-3.0.2-CVE-2026-58380.patch Patch3000: gimp-2.10.12-default-font.patch BuildRequires: gcc glib2-devel meson ninja-build pkgconfig @@ -271,6 +282,10 @@ cat gimp-plugin-files gimp-all.lang > gimp.files %changelog +* Thu Aug 06 2026 PkgAgent Robot - 3.0.2-5 +- [Type] security +- [DESC] Fix CVE-2026-58380, CVE-2026-0797, CVE-2026-2047, CVE-2026-2045, CVE-2026-2044, CVE-2026-2048, CVE-2025-14425, CVE-2025-14424, CVE-2025-14423, CVE-2025-14422 + * Wed Apr 08 2026 PkgAgent Robot - 3.0.2-4 - [Type] security - [DESC] Fix CVE-2025-10925, CVE-2025-10934, CVE-2025-10922, CVE-2025-10924, CVE-2025-10920, CVE-2025-10923