Описание
Security update for gimp
This update for gimp fixes the following issues:
Changes in gimp:
- CVE-2026-66757: signed integer overflow in
file-sgicauses the plugin to crash when RLE-compressed SGI images are processed (bsc#1273151) - CVE-2026-66758: integer overflow in
file-fitsplugin causes a heap-based buffer overflow when crafted FITS images are processed (bsc#1273152) - CVE-2026-66759: out-of-bounds read in
file-icnsplugin causes information disclosure or crash when crafted ICNS images are processed (bsc#1273153)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1273151
- SUSE Bug 1273152
- SUSE Bug 1273153
- SUSE CVE CVE-2026-66757 page
- SUSE CVE CVE-2026-66758 page
- SUSE CVE CVE-2026-66759 page
Описание
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-66757
- SUSE Bug 1273151
Описание
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-66758
- SUSE Bug 1273152
Описание
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed.
Затронутые продукты
Ссылки
- CVE-2026-66759
- SUSE Bug 1273153