Your message dated Mon, 21 Sep 2026 18:04:41 +0000
with message-id <[email protected]>
and subject line Bug#1146133: fixed in gimp 3.0.4-3+deb13u11
has caused the Debian Bug report #1146133,
regarding gimp: CVE-2026-82328
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146133: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146133
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gimp
Version: 3.2.4-3
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16585
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for gimp.
CVE-2026-82328[0]:
| A flaw was found in the file-ico plugin in GIMP. When processing a
| specially crafted ICO image file, the plugin does not properly
| validate the used_clrs (palette count) parameter. This incorrect
| validation leads to improper memory bounds checking, resulting in a
| heap out-of-bounds read. This issue can result in an application
| crash, leading to a denial of service or a limited information
| disclosure of heap memory contents.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-82328
https://www.cve.org/CVERecord?id=CVE-2026-82328
[1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16585
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: gimp
Source-Version: 3.0.4-3+deb13u11
Done: Moritz Mühlenhoff <[email protected]>
We believe that the bug you reported is fixed in the latest version of
gimp, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Moritz Mühlenhoff <[email protected]> (supplier of updated gimp package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 19 Sep 2026 17:17:20 +0200
Source: gimp
Architecture: source
Version: 3.0.4-3+deb13u11
Distribution: trixie-security
Urgency: medium
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Moritz Mühlenhoff <[email protected]>
Closes: 1145874 1145875 1146133
Changes:
gimp (3.0.4-3+deb13u11) trixie-security; urgency=medium
.
* CVE-2026-92248
* CVE-2026-90947
* CVE-2026-82328 (Closes: #1146133)
* CVE-2026-90948
* CVE-2026-78465 (Closes: #1145875)
* CVE-2026-78475 (Closes: #1145874)
Checksums-Sha1:
13dda2ed30326c4690b903cd3e2e65b5f707f12e 3927 gimp_3.0.4-3+deb13u11.dsc
a9c615e90389b65ecead2e9e0d04a565b6e5c0dc 86332
gimp_3.0.4-3+deb13u11.debian.tar.xz
6f7048154eafa4f475cb64bde61d3d9b821fccc4 24914
gimp_3.0.4-3+deb13u11_amd64.buildinfo
Checksums-Sha256:
d4db578048a46b520dfe8dec836e5d16d302a70b1852ebc6193c5f41f6974710 3927
gimp_3.0.4-3+deb13u11.dsc
f1110c39828bcb9ce8a4cca8ee544f034aeb8b3228970eeada64848760c1bbbf 86332
gimp_3.0.4-3+deb13u11.debian.tar.xz
ff9127936247ec838d39aebf00ad8eb0f0cdec5862a31ac87eebd914dfae028f 24914
gimp_3.0.4-3+deb13u11_amd64.buildinfo
Files:
815da2585a2e9f22e37267acfaba0ce3 3927 graphics optional
gimp_3.0.4-3+deb13u11.dsc
8c4b0fd556408d77adcc1b0ecc9efcaa 86332 graphics optional
gimp_3.0.4-3+deb13u11.debian.tar.xz
3691b0d5a673607909c90b46bd9f701f 24914 graphics optional
gimp_3.0.4-3+deb13u11_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmqu4zwACgkQEMKTtsN8
TjaReg/8DFDEzv4hquNwoFZHyq/8DoHcnrIk8BASOOHaaqZt/FtwI1qOpuPtpSm6
JP6YPkx/0hAb58wLeMAT/AwQEbMQmCPSPgdc1xLqndx9kcZSZUzrchpcdRa96qJi
mSssk3g64ZmI1vZSC4K+V+l2uLJLg3ERHza3d/hmjT97oq17dn0zHBof2robz7zQ
Q5N7GnluEvcKltVG0+mWR9zsRlbMUC3nAYXoLjaR/Tgf8LamKR2EoDte9uJybdH0
8HFge0zxVHPpjwfP/0QTKW7KV0H9k0fN6+UCTEnx3Xzs1PfpCbwQVZkHr2fI2D20
a8lGykLNteAuO0rWluhnYdiBTEPRE0UEWonlDgr0jxCFXL7Fxv7+dlKWNEODaNDa
fbN0iKh606D6RuzeE5XdLwOyX0mXY8TinlRMKSKtqwNN99SJQIyH+qsD84QD2b7L
pK6q/7lsR0KbTll61AObarma9jOrDq/sk71zA2r8HT2z7ZpBrPgsxQWyXm4WGtpb
VUc0fcOdikYFxyRBjyFlcH/edbUZvl4uxkTP1ULKHqLbRFN/5rq10UN0B/SgRKvt
1YP6JQkpqekHGE8+VGB5CTIZ29cO3Z0/SyGVzxi6ZgV8f0QzrZGMtJjZRqJ/dFqF
AvGALqV/BdYJw1uhBIwkCFB13o44l16/j/BamEZ96c4JHSUtRp4=
=GskM
-----END PGP SIGNATURE-----
pgpuwBhbDTOpk.pgp
Description: PGP signature
--- End Message ---
