Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gimp for openSUSE:Factory checked in at 2026-10-08 11:55:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gimp (Old) and /work/SRC/openSUSE:Factory/.gimp.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gimp" Thu Oct 8 11:55:02 2026 rev:175 rq:1382680 version:3.2.6 Changes: -------- --- /work/SRC/openSUSE:Factory/gimp/gimp.changes 2026-09-28 10:37:51.116338091 +0200 +++ /work/SRC/openSUSE:Factory/.gimp.new.3698736/gimp.changes 2026-10-08 11:55:08.974337104 +0200 @@ -1,0 +2,10 @@ +Thu Oct 1 15:19:09 UTC 2026 - Michael Gorse <[email protected]> + +- CVE-2026-96546: one-byte out-of-bounds heap read in the + uncompressed DDS loader (bsc#1282601) + * gimp-CVE-2026-96546.patch +- CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via + crafted preset file (bsc#1282596) + * gimp-CVE-2026-97185.patch + +------------------------------------------------------------------- New: ---- gimp-CVE-2026-96546.patch gimp-CVE-2026-97185.patch ----------(New B)---------- New: uncompressed DDS loader (bsc#1282601) * gimp-CVE-2026-96546.patch - CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via New: crafted preset file (bsc#1282596) * gimp-CVE-2026-97185.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gimp.spec ++++++ --- /var/tmp/diff_new_pack.5ypIiX/_old 2026-10-08 11:55:10.978421021 +0200 +++ /var/tmp/diff_new_pack.5ypIiX/_new 2026-10-08 11:55:10.980421105 +0200 @@ -122,6 +122,10 @@ Patch12: gimp-CVE-2026-96544-2.patch # PATCH-FIX-UPSTREAM gimp-CVE-2026-96545.patch bsc#1282602 [email protected] -- Guard loading 4BPP TIM images. Patch13: gimp-CVE-2026-96545.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-96546.patch bsc#1282601 [email protected] -- plug-ins/file-dds: Fix buffer overrun. +Patch14: gimp-CVE-2026-96546.patch +# PATCH-FIX-UPSTREAM gimp-CVE-2026-97185.patch bsc#1282596 [email protected] -- fix out-of-bound write in gimpressionist preset. +Patch15: gimp-CVE-2026-97185.patch %if %{with debug_in_build_gimp} BuildRequires: gdb %endif ++++++ gimp-CVE-2026-96546.patch ++++++ >From 108c72aab28fe069129ad0e545d6b97de5c0ce2f Mon Sep 17 00:00:00 2001 From: Jacob Boerema <[email protected]> Date: Mon, 21 Sep 2026 11:51:32 -0400 Subject: [PATCH] plug-ins/file-dds: Fix buffer overrun When loading certain DDS images, a buffer overrun could happen at the last byte read. This happens because a next byte to process is always read, before checking if we are done. See issue #16797 To make processing easier, I decided to allocate one byte extra instead of extra conditions in the input processing loop. Additionally, in the case the DDSD_PITCH flag is set, we read one rowstride length of bytes, but did not reset the buffer position after processing a row. Now this doesn't make a real difference because the buffer is the same whole image size regardless. However, to reduce future surprises, let's reset the buffer position after each row. --- plug-ins/file-dds/ddsread.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/plug-ins/file-dds/ddsread.c b/plug-ins/file-dds/ddsread.c index e22aec7d2a..fe3bd2c1c3 100644 --- a/plug-ins/file-dds/ddsread.c +++ b/plug-ins/file-dds/ddsread.c @@ -566,7 +566,7 @@ read_dds (GFile *file, load_info.tile_height = gimp_tile_height (); pixels = g_new (guchar, load_info.tile_height * load_info.width * load_info.gimp_bpp); - buf = g_malloc (load_info.linear_size); + buf = g_malloc (load_info.linear_size + 1); if (load_info.cubemap_faces) /* Cubemap texture */ { @@ -1245,9 +1245,10 @@ load_layer (FILE *fp, if (! (load_info->fmt_flags & DDPF_FOURCC)) /* Read uncompressed pixel data */ { - guint rowstride = width * load_info->bpp; - guint32 sign_add[4] = { 0, 0, 0, 0 }; - guint idx_r = 0, idx_b = 2; + guint rowstride = width * load_info->bpp; + guint32 sign_add[4] = { 0, 0, 0, 0 }; + guint idx_r = 0, idx_b = 2; + guchar *pbuf = buf; /* Prior plug-in versions (3.9.91 and earlier) wrote the R and G channels reversed for RGB10A2. */ if ((load_info->gimp_version > 0) && @@ -1318,6 +1319,7 @@ load_layer (FILE *fp, _("Requested data exceeds size of file.\n")); return FALSE; } + buf = pbuf; if (! fread (buf, rowstride, 1, fp)) { g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, -- 2.55.0 ++++++ gimp-CVE-2026-97185.patch ++++++ >From 3b5e12f8eb2734f954559fbdaf27d03765cea2e5 Mon Sep 17 00:00:00 2001 From: Harsh Verma <[email protected]> Date: Sat, 19 Sep 2026 10:08:22 +0530 Subject: [PATCH] plug-ins: fix out-of-bound write in gimpressionist preset loader The preset loader took the vector index straight from the file and used it to index a fixed 50 slot array, without checking it. So a crafted line writes anywhere past the array, and a negative index writes before it. So I added a check to not write indexes which negative or beyond limit. --- plug-ins/gimpressionist/presets.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/plug-ins/gimpressionist/presets.c b/plug-ins/gimpressionist/presets.c index bb43e1d80fd..f073ff1b936 100644 --- a/plug-ins/gimpressionist/presets.c +++ b/plug-ins/gimpressionist/presets.c @@ -285,6 +285,10 @@ set_orient_vector (const gchar *str) n = atoi (tmps); + /* index comes from the file, don't trust it */ + if (n < 0 || n >= MAXORIENTVECT) + return; + if (!(tmps = strchr (tmps, ','))) return; pcvals.orient_vectors[n].x = g_ascii_strtod (++tmps, NULL); @@ -322,6 +326,10 @@ static void set_size_vector (const gchar *str) n = atoi (tmps); + /* index comes from the file, don't trust it */ + if (n < 0 || n >= MAXSIZEVECT) + return; + if (!(tmps = strchr (tmps, ','))) return; pcvals.size_vectors[n].x = g_ascii_strtod (++tmps, NULL); -- GitLab
