Your message dated Sun, 20 Sep 2026 09:24:44 +0200
with message-id
<caaajcmay9o+vgknyn-p2o67oduqayekfs48d7oorjatw0ju...@mail.gmail.com>
and subject line Re: Bug#1148480: gimp: CVE-2026-90948
has caused the Debian Bug report #1148480,
regarding gimp: CVE-2026-90948
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148480: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148480
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gimp
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerability was published for gimp.
CVE-2026-90948[0]:
| A flaw was found in GIMP's ICO file loader. When processing an ICO
| file containing an embedded PNG image, an integer overflow can occur
| during the calculation of the required buffer size. This leads to an
| undersized buffer being allocated, causing a heap-based buffer
| overflow when the decoded pixel data is written. A remote attacker
| could exploit this by crafting a malicious ICO file, which, when
| opened, could lead to arbitrary code execution or a crash.
https://gitlab.gnome.org/GNOME/gimp/-/work_items/16742
Fixed by:
https://gitlab.gnome.org/GNOME/gimp/-/commit/123d6360b8d7e2a00a9d913889ee9cdca88e2380
(master)
Fixed by:
https://gitlab.gnome.org/GNOME/gimp/-/commit/07c8d365873dc748a11a2df19e7a9eeab1c10667
(gimp-3-2 branch)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-90948
https://www.cve.org/CVERecord?id=CVE-2026-90948
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Version: 3.2.6-1
On Sun, Sep 20, 2026 at 12:25 AM Moritz Mühlenhoff <[email protected]> wrote:
> Fixed by:
> https://gitlab.gnome.org/GNOME/gimp/-/commit/123d6360b8d7e2a00a9d913889ee9cdca88e2380
> (master)
> Fixed by:
> https://gitlab.gnome.org/GNOME/gimp/-/commit/07c8d365873dc748a11a2df19e7a9eeab1c10667
> (gimp-3-2 branch)
This is
https://salsa.debian.org/gnome-team/extras/gimp/-/blob/debian/latest/debian/patches/16742.patch
Thank you,
Jeremy Bícha
--- End Message ---
