Описание
Security update for gimp
This update for gimp fixes the following issues:
Security issues fixed:
- CVE-2026-59088: denial of service via signed integer overflow in FLI file processing (bsc#1274837).
- CVE-2026-59090: arbitrary code execution in PSD plugin due to unsigned underflow (bsc#1274840).
- CVE-2026-66757: signed integer overflow in
file-sgicauses the plugin to crash when RLE-compressed SGI images are processed (bsc#1273151). - CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations (bsc#1277378).
- CVE-2026-80101: independent header field validation in the XWD loader can cause heap out-of-bounds reads (bsc#1276911).
Non security issues fixed:
- RLE-compressed SGI files are written with a bad offset table and 57 of 144 scanlines fail to decode, on the patched and the released build alike (bsc#1279838).
- XWD bytes-per-line guard can never fire, and load_xwd_f1_d24_b1() still allocates the unchecked header field (bsc#1279839).
Список пакетов
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Workstation Extension 15 SP7
Ссылки
- Link for SUSE-SU-2026:4309-1
- E-Mail link for SUSE-SU-2026:4309-1
- SUSE Security Ratings
- SUSE Bug 1273151
- SUSE Bug 1274837
- SUSE Bug 1274840
- SUSE Bug 1276911
- SUSE Bug 1277378
- SUSE Bug 1279838
- SUSE Bug 1279839
- SUSE CVE CVE-2026-59088 page
- SUSE CVE CVE-2026-59090 page
- SUSE CVE CVE-2026-66757 page
- SUSE CVE CVE-2026-78465 page
- SUSE CVE CVE-2026-80101 page
Описание
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-59088
- SUSE Bug 1274837
Описание
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system.
Затронутые продукты
Ссылки
- CVE-2026-59090
- SUSE Bug 1274840
Описание
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-66757
- SUSE Bug 1273151
- SUSE Bug 1279838
- SUSE Bug 1279839
Описание
A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-78465
- SUSE Bug 1277378
Описание
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of heap memory contents into the produced image.
Затронутые продукты
Ссылки
- CVE-2026-80101
- SUSE Bug 1276911
- SUSE Bug 1279839