Your message dated Sat, 27 Jun 2026 10:06:41 +0200
with message-id
<amsi6gbckmu63vneb3ume2ydhup5mbtoo6pq2fd7lbxrlgefd7@zs6ivc7oso7y>
and subject line Re: Bug#1132846: gimp - Insecurely creates /tmp/gimp/3.2
has caused the Debian Bug report #1132846,
regarding gimp - Insecurely creates /tmp/gimp/3.2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1132846: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132846
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gimp
Version: 3.2.2-1
Severity: serious
Tags: security
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Starting gimp creates /tmp/gimp/3.2 in an insecure way. Neither is the
name randomized, nor is there much care taken with creating the
directory in a secure way in a world writable directory. This should be
CWE-378.
strace shows:
| execve("/usr/bin/gimp", ["gimp"], 0x7ffd48a2e5a0 /* 57 vars */) = 0
| […]
| newfstatat(AT_FDCWD, "/usr/bin/convert", {st_mode=S_IFREG|0755,
st_size=15016, ...}, 0) = 0
| faccessat2(AT_FDCWD, "/tmp/gimp/3.2", F_OK, AT_SYMLINK_NOFOLLOW|AT_EACCESS) =
-1 ENOENT (No such file or directory)
| mkdir("/tmp/gimp/3.2", 0777) = -1 ENOENT (No such file or
directory)
| mkdir("/tmp/gimp", 0777) = 0
| mkdir("/tmp/gimp/3.2", 0777) = 0
| faccessat2(AT_FDCWD, "/home/waldi/.cache/gimp/3.2", F_OK,
AT_SYMLINK_NOFOLLOW|AT_EACCESS) = 0
| newfstatat(AT_FDCWD, "/home/waldi/.cache/gimp/3.2", {st_mode=S_IFDIR|0755,
st_size=0, ...}, 0) = 0
| openat(AT_FDCWD, "/home/waldi/.cache/gimp/3.2",
O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 13
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (700, 'testing'), (500, 'unstable-debug'), (500,
'stable-updates'), (500, 'oldstable-updates'), (500, 'unstable'), (500,
'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 6.19.8+deb14-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages gimp depends on:
ii gimp-data 3.2.2-1
ii gir1.2-gimp-3.0 3.2.2-1
ii graphviz 14.1.2-1
ii libaa1 1.4p5-51.1+b2
ii libappstream5 1.1.2-1
ii libarchive13t64 3.8.5-1
ii libasound2t64 1.2.15.3-1
ii libbabl-0.1-0 1:0.1.124-1
ii libbz2-1.0 1.0.8-6+b1
ii libc6 2.42-14
ii libcairo2 1.18.4-3
ii libcfitsio10t64 4.6.3-1+b1
ii libfontconfig1 2.17.1-5
ii libfreetype6 2.14.2+dfsg-1
ii libgcc-s1 16-20260322-1
ii libgdk-pixbuf-2.0-0 2.44.5+dfsg-4
ii libgegl-0.4-0t64 1:0.4.70-1
ii libgexiv2-2 0.14.6-2
ii libgimp-3.0-0 3.2.2-1
ii libglib2.0-0t64 2.88.0-1
ii libgomp1 16-20260322-1
ii libgs10 10.07.0~dfsg-2
ii libgtk-3-0t64 3.24.52-1
ii libgudev-1.0-0 238-7+b1
ii libharfbuzz0b 12.3.2-2+b2
ii libheif1 1.21.2-4
ii libjpeg62-turbo 1:2.1.5-4
ii libjson-glib-1.0-0 1.10.8+ds-2
ii libjxl0.11 0.11.2-0.1
ii liblcms2-2 2.17-1
ii liblzma5 5.8.2-2
ii libmng2 2.0.3+dfsg-5
ii libmypaint-1.5-1 1.6.0-4+b1
ii libopenexr-3-4-33 3.4.6+ds-4
ii libopenjp2-7 2.5.4-1
ii libpango-1.0-0 1.57.1-1
ii libpangocairo-1.0-0 1.57.1-1
ii libpangoft2-1.0-0 1.57.1-1
ii libpng16-16t64 1.6.56-1
ii libpoppler-glib8t64 25.03.0-11.1+b1
ii librsvg2-2 2.61.3+dfsg-3+b1
ii librsvg2-common 2.61.3+dfsg-3+b1
ii libstdc++6 16-20260322-1
ii libtiff6 4.7.1-1
ii libwebp7 1.5.0-0.1+b1
ii libwebpdemux2 1.5.0-0.1+b1
ii libwebpmux3 1.5.0-0.1+b1
ii libwmf-0.2-7 0.2.14-1
ii libwmflite-0.2-7 0.2.14-1
ii libx11-6 2:1.8.13-1
ii libxcursor1 1:1.2.3-1+b1
ii libxext6 2:1.3.4-1+b4
ii libxfixes3 1:6.0.0-2+b5
ii libxmu6 2:1.1.3-4
ii libxpm4 1:3.5.17-1+b4
ii python3-gi 3.56.1-2
ii python3-gi-cairo 3.56.1-2
ii xdg-utils 1.2.1-2
ii zlib1g 1:1.3.dfsg+really1.3.1-3
Versions of packages gimp recommends:
ii ghostscript 10.07.0~dfsg-2
Versions of packages gimp suggests:
pn gimp-data-extras <none>
pn gimp-help-en | gimp-help <none>
ii gvfs-backends 1.60.0-1
ii python3 3.13.9-3
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 3.2.4-1
On Sat, Jun 27, 2026 at 08:53:21AM +0200, Paul Gevers wrote:
> That's my observation as well, so lets document that the version in unstable
> is fixed. (I'm not closing the bug just yet, to allow for further
> inspection/tracking).
This was fixed with:
| commit a85e5286fd2064bfd684e85f3536626bcc2973cb
| Author: Jehan <[email protected]>
| Date: Mon Apr 6 16:09:09 2026 +0200
|
| Issue #14681: Permission denied opening image - /tmp/gimp/3.0/ cannot be
shared.
|
| Let's create the folder returned by gimp_temp_directory() ourselves, the
| first time this function is called, using a randomized name. This will
| ensure that we won't conflict with another user running GIMP on the same
| machine if using the base /tmp/ (which is usually the case on Linux).
|
| Furthermore, since we create the temp folder at this level, we will also
| delete it when quitting (but only if it's empty, as it should). Also I
| use a single-level folder above the generic temporary directory, this
| way, it's easier to track and we don't have to delete 2 levels of
| directories anymore.
|
| When the environment variable GIMP3_TEMPDIR is set though, we do not
| create the folder, nor do we try and delete it.
Bastian
--
Youth doesn't excuse everything.
-- Dr. Janice Lester (in Kirk's body), "Turnabout Intruder",
stardate 5928.5.
--- End Message ---
