Version in base suite: 3.0.4-3+deb13u9 Base version: gimp_3.0.4-3+deb13u9 Target version: gimp_3.0.4-3+deb13u10 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gimp/gimp_3.0.4-3+deb13u9.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gimp/gimp_3.0.4-3+deb13u10.dsc changelog | 22 ++++++++++++ patches/CVE-2026-18301.patch | 56 ++++++++++++++++++++++++++++++ patches/CVE-2026-18302.patch | 16 ++++++++ patches/CVE-2026-18303.patch | 32 +++++++++++++++++ patches/CVE-2026-18304.patch | 49 +++++++++++++++++++++++++++ patches/CVE-2026-18305.patch | 30 ++++++++++++++++ patches/CVE-2026-18306.patch | 47 +++++++++++++++++++++++++ patches/CVE-2026-18307.patch | 28 +++++++++++++++ patches/CVE-2026-18308.patch | 46 +++++++++++++++++++++++++ patches/CVE-2026-42170.patch | 29 +++++++++++++++ patches/CVE-2026-58379.patch | 49 +++++++++++++++++++++++++++ patches/CVE-2026-58380.patch | 16 ++++++++ patches/CVE-2026-58381.patch | 60 +++++++++++++++++++++++++++++++++ patches/CVE-2026-58384.patch | 34 ++++++++++++++++++ patches/CVE-2026-59088.patch | 78 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-59090.patch | 74 ++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-66758.patch | 23 ++++++++++++ patches/CVE-2026-66759.patch | 38 ++++++++++++++++++++ patches/series | 17 +++++++++ 19 files changed, 744 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpo0xwku2p/gimp_3.0.4-3+deb13u9.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpo0xwku2p/gimp_3.0.4-3+deb13u10.dsc: no acceptable signature found diff -Nru gimp-3.0.4/debian/changelog gimp-3.0.4/debian/changelog --- gimp-3.0.4/debian/changelog 2026-06-10 07:56:42.000000000 +0000 +++ gimp-3.0.4/debian/changelog 2026-08-21 19:03:47.000000000 +0000 @@ -1,3 +1,25 @@ +gimp (3.0.4-3+deb13u10) trixie-security; urgency=medium + + * CVE-2026-18301 + * CVE-2026-18302 + * CVE-2026-18303 + * CVE-2026-18304 + * CVE-2026-18305 + * CVE-2026-18306 + * CVE-2026-18307 + * CVE-2026-18308 + * CVE-2026-42170 + * CVE-2026-58379 (Closes: #1141415) + * CVE-2026-58380 + * CVE-2026-58381 + * CVE-2026-58384 + * CVE-2026-59088 (Closes: #1144528) + * CVE-2026-59090 (Closes: #1144526) + * CVE-2026-66758 (Closes: #1142991) + * CVE-2026-66759 (Closes: #1142992) + + -- Moritz Mühlenhoff Fri, 21 Aug 2026 21:03:47 +0200 + gimp (3.0.4-3+deb13u9) trixie; urgency=medium * Non-maintainer upload. diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18301.patch gimp-3.0.4/debian/patches/CVE-2026-18301.patch --- gimp-3.0.4/debian/patches/CVE-2026-18301.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18301.patch 2026-08-21 15:47:18.000000000 +0000 @@ -0,0 +1,56 @@ +From b1f46e63c82065bd60e84359fb729380d5b043bf Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 15:50:19 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29395 + +--- gimp-3.0.4.orig/plug-ins/file-psd/psd-load.c ++++ gimp-3.0.4/plug-ins/file-psd/psd-load.c +@@ -3328,28 +3328,39 @@ read_channel_data (PSDchannel *chann + guint32 comp_len, + GError **error) + { +- gchar *raw_data = NULL; +- gchar *src; +- guint32 readline_len; ++ gchar *raw_data = NULL; ++ gchar *src; ++ gsize readline_len; ++ gsize allocation; + + if (bps == 1) +- readline_len = ((channel->columns + 7) / 8); ++ readline_len = (gsize) ((channel->columns + 7) / 8); + else +- readline_len = (channel->columns * bps / 8); ++ readline_len = (gsize) (channel->columns * bps / 8); + +- IFDBG(4) g_debug ("raw data size %d x %d = %d", readline_len, ++ IFDBG(4) g_debug ("raw data size %" G_GSIZE_FORMAT " x %d = %" G_GSIZE_FORMAT, ++ readline_len, + channel->rows, readline_len * channel->rows); + + /* sanity check, int overflow check (avoid divisions by zero) */ +- if ((channel->rows == 0) || (channel->columns == 0) || +- (channel->rows > G_MAXINT32 / channel->columns / MAX (bps / 8, 1))) ++ if ((channel->rows == 0) || (channel->columns == 0) || ++ (channel->rows >= G_MAXINT32 / channel->columns / MAX (bps / 8, 1)) || ++ ! g_size_checked_mul (&allocation, readline_len, channel->rows)) + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Unsupported or invalid channel size")); + return -1; + } + +- raw_data = g_malloc (readline_len * channel->rows); ++ raw_data = g_try_malloc (allocation); ++ if (raw_data == NULL) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("There was not enough memory to complete the " ++ "operation.")); ++ return -1; ++ } ++ + switch (compression) + { + case PSD_COMP_RAW: diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18302.patch gimp-3.0.4/debian/patches/CVE-2026-18302.patch --- gimp-3.0.4/debian/patches/CVE-2026-18302.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18302.patch 2026-08-21 15:48:07.000000000 +0000 @@ -0,0 +1,16 @@ +From 77e1a11636fae53c922fe92273b8f4e33c7a9176 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Mon, 20 Apr 2026 12:35:40 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29398 + +--- gimp-3.0.4.orig/plug-ins/file-tiff/file-tiff-load.c ++++ gimp-3.0.4/plug-ins/file-tiff/file-tiff-load.c +@@ -2247,7 +2247,7 @@ load_separate (TIFF *tif, + else if (is_signed) + { + convert_int2uint (buffer, bps, 1, cols, rows, +- tile_width * bytes_per_pixel); ++ tile_width * (bps / 8)); + } + + if (tiff_mode == GIMP_TIFF_GRAY_MINISWHITE && bps == 8) diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18303.patch gimp-3.0.4/debian/patches/CVE-2026-18303.patch --- gimp-3.0.4/debian/patches/CVE-2026-18303.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18303.patch 2026-08-21 15:48:37.000000000 +0000 @@ -0,0 +1,32 @@ +From 5633b362026c6e5b2beb559a10cd76fa32a47592 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 17:15:06 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29399 + +--- gimp-3.0.4.orig/plug-ins/file-tiff/file-tiff-load.c ++++ gimp-3.0.4/plug-ins/file-tiff/file-tiff-load.c +@@ -1420,7 +1420,7 @@ load_image (GimpProcedure *proced + /* Install colormap for INDEXED images only */ + if (image_type == GIMP_INDEXED) + { +- guchar cmap[768]; ++ guchar cmap[768]; + + if (photomet == PHOTOMETRIC_PALETTE) + { +@@ -1438,6 +1438,15 @@ load_image (GimpProcedure *proced + return GIMP_PDB_EXECUTION_ERROR; + } + ++ /* TODO: Remove when we support 16 bit indexed TIFFs */ ++ if (bps > 8) ++ { ++ TIFFClose (tif); ++ g_message (_("Indexed TIFFs with color maps larger than 256" ++ "colors are not yet supported")); ++ return GIMP_PDB_EXECUTION_ERROR; ++ } ++ + for (i = 0, j = 0; i < (1 << bps); i++) + { + cmap[j++] = redmap[i] >> 8; diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18304.patch gimp-3.0.4/debian/patches/CVE-2026-18304.patch --- gimp-3.0.4/debian/patches/CVE-2026-18304.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18304.patch 2026-08-21 16:25:55.000000000 +0000 @@ -0,0 +1,49 @@ +From ad32d22c347674fa1bb5b60935c376b673d946e7 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 01:01:47 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29403 + +--- gimp-3.0.4.orig/plug-ins/file-tiff/file-tiff-load.c ++++ gimp-3.0.4/plug-ins/file-tiff/file-tiff-load.c +@@ -1994,8 +1994,19 @@ load_contiguous (TIFF *tif, + + if (tiff_mode != GIMP_TIFF_DEFAULT && bps < 8) + { ++ gsize tile_area = (gsize) tile_width * tile_height; ++ + needs_upscale = TRUE; +- bw_buffer = g_malloc (tile_width * tile_height); ++ bw_buffer = g_try_malloc (tile_area); ++ ++ if (! bw_buffer) ++ { ++ g_message (_("There was not enough memory to complete the " ++ "operation.")); ++ g_free (buffer); ++ g_free (bw_buffer); ++ return; ++ } + } + + one_row = (gdouble) tile_height / (gdouble) image_height; +@@ -2171,8 +2182,19 @@ load_separate (TIFF *tif, + + if (tiff_mode != GIMP_TIFF_DEFAULT && bps < 8) + { ++ gsize tile_area = (gsize) tile_width * tile_height; ++ + needs_upscale = TRUE; +- bw_buffer = g_malloc (tile_width * tile_height); ++ bw_buffer = g_try_malloc (tile_area); ++ ++ if (! bw_buffer) ++ { ++ g_message (_("There was not enough memory to complete the " ++ "operation.")); ++ g_free (buffer); ++ g_free (bw_buffer); ++ return; ++ } + } + + one_row = (gdouble) tile_height / (gdouble) image_height; diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18305.patch gimp-3.0.4/debian/patches/CVE-2026-18305.patch --- gimp-3.0.4/debian/patches/CVE-2026-18305.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18305.patch 2026-08-21 16:27:52.000000000 +0000 @@ -0,0 +1,30 @@ +From 0a45a2b51b877829ef523131b50c0eb2a933b8a1 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 19 Apr 2026 03:16:09 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29406 + +--- gimp-3.0.4.orig/plug-ins/file-tiff/file-tiff-load.c ++++ gimp-3.0.4/plug-ins/file-tiff/file-tiff-load.c +@@ -1904,13 +1904,21 @@ load_rgba (TIFF *tif, + guint32 image_height; + guint32 row; + guint32 *buffer; ++ gsize allocation; + + g_printerr ("%s\n", __func__); + + TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &image_width); + TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &image_height); + +- buffer = g_new (uint32_t, image_width * image_height); ++ if (! g_size_checked_mul (&allocation, image_width, image_height) || ++ ! g_size_checked_mul (&allocation, allocation, 4) || ++ (buffer = g_try_malloc0 (allocation)) == NULL) ++ { ++ g_message (_("There was not enough memory to complete the " ++ "operation.")); ++ return; ++ } + + if (! TIFFReadRGBAImage (tif, image_width, image_height, buffer, 0)) + { diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18306.patch gimp-3.0.4/debian/patches/CVE-2026-18306.patch --- gimp-3.0.4/debian/patches/CVE-2026-18306.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18306.patch 2026-08-21 16:28:24.000000000 +0000 @@ -0,0 +1,47 @@ +From 76531da9732f38566e5fd8f8f80c837158511ae5 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 18:48:27 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29396 + +--- gimp-3.0.4.orig/plug-ins/file-sgi/sgi-lib.c ++++ gimp-3.0.4/plug-ins/file-sgi/sgi-lib.c +@@ -315,14 +315,20 @@ sgiOpenFile(FILE *file, /* I - File to o + } + } + +- sgip->comp = getc(sgip->file); +- sgip->bpp = getc(sgip->file); +- getshort(sgip); /* Dimensions */ +- sgip->xsize = getshort(sgip); +- sgip->ysize = getshort(sgip); +- sgip->zsize = getshort(sgip); +- getlong(sgip); /* Minimum pixel */ +- getlong(sgip); /* Maximum pixel */ ++ sgip->comp = getc (sgip->file); ++ sgip->bpp = getc (sgip->file); ++ if (sgip->bpp > 2) ++ { ++ free (sgip); ++ return (NULL); ++ } ++ ++ getshort (sgip); /* Dimensions */ ++ sgip->xsize = getshort (sgip); ++ sgip->ysize = getshort (sgip); ++ sgip->zsize = getshort (sgip); ++ getlong (sgip); /* Minimum pixel */ ++ getlong (sgip); /* Maximum pixel */ + + if (sgip->comp) + { +--- gimp-3.0.4.orig/plug-ins/file-sgi/sgi.c ++++ gimp-3.0.4/plug-ins/file-sgi/sgi.c +@@ -474,7 +474,7 @@ load_image (GFile *file, + pixels[0] = g_new (guchar, ((gsize) tile_height) * sgip->xsize * sgip->bpp * bytes); + + for (i = 1; i < tile_height; i ++) +- pixels[i] = pixels[0] + sgip->xsize * sgip->bpp * bytes * i; ++ pixels[i] = pixels[0] + (((gsize) sgip->xsize) * sgip->bpp * bytes * i); + + rows = g_new (unsigned short *, sgip->zsize); + rows[0] = g_new (unsigned short, ((gsize) sgip->xsize) * sgip->zsize); diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18307.patch gimp-3.0.4/debian/patches/CVE-2026-18307.patch --- gimp-3.0.4/debian/patches/CVE-2026-18307.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18307.patch 2026-08-21 16:29:56.000000000 +0000 @@ -0,0 +1,28 @@ +From bace3e7fd54104fe6b70c1703e9b982a4770811d Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Fri, 5 Jun 2026 18:00:21 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29404 + +--- gimp-3.0.4.orig/plug-ins/file-tiff/file-tiff-load.c ++++ gimp-3.0.4/plug-ins/file-tiff/file-tiff-load.c +@@ -213,7 +213,8 @@ tiff_get_page_name (TIFF *tif) + + /* is_non_conformant_tiff assumes TIFFTAG_EXTRASAMPLES was not set */ + static gboolean +-is_non_conformant_tiff (gushort photomet, gushort spp) ++is_non_conformant_tiff (gushort photomet, ++ gushort spp) + { + switch (photomet) + { +@@ -2022,8 +2023,8 @@ load_contiguous (TIFF *tif, + src_format = babl_format_n (type, spp); + + /* consistency check */ +- bytes_per_pixel = 0; +- for (i = 0; i <= extra; i++) ++ bytes_per_pixel = babl_format_get_bytes_per_pixel (src_format); ++ for (i = 1; i <= extra; i++) + bytes_per_pixel += babl_format_get_bytes_per_pixel (channel[i].format); + + g_printerr ("bytes_per_pixel: %d, format: %d\n", diff -Nru gimp-3.0.4/debian/patches/CVE-2026-18308.patch gimp-3.0.4/debian/patches/CVE-2026-18308.patch --- gimp-3.0.4/debian/patches/CVE-2026-18308.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-18308.patch 2026-08-21 16:31:19.000000000 +0000 @@ -0,0 +1,46 @@ +From d84f8e58f56681a0b4c66129c568cb796725ab9d Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 18 Apr 2026 18:15:41 +0000 +Subject: [PATCH] plug-ins: Mitigate ZDI-CAN-29405 + +--- gimp-3.0.4.orig/plug-ins/file-tiff/file-tiff-load.c ++++ gimp-3.0.4/plug-ins/file-tiff/file-tiff-load.c +@@ -2447,6 +2447,7 @@ load_sketchbook_layers (TIFF *tif, + gboolean visible = TRUE; + gboolean locked = FALSE; + guint32 *pixels; ++ gsize pixels_size; + guint32 row; + + layer_settings = g_strsplit (alias_sublayer_info, ", ", 10); +@@ -2467,6 +2468,22 @@ load_sketchbook_layers (TIFF *tif, + + TIFFGetField (tif, TIFFTAG_IMAGEWIDTH, &layer_width); + TIFFGetField (tif, TIFFTAG_IMAGELENGTH, &layer_height); ++ if (layer_width > GIMP_MAX_IMAGE_SIZE || ++ layer_height > GIMP_MAX_IMAGE_SIZE) ++ { ++ g_message (_("Invalid image dimensions (%u x %u) for " ++ "Sketchbook layer %i. Image may be corrupt."), ++ layer_width, layer_height, i + 1); ++ continue; ++ } ++ ++ if (! g_size_checked_mul (&pixels_size, layer_width, layer_height) || ++ ! g_size_checked_mul (&pixels_size, pixels_size, 4) || ++ (pixels = g_try_malloc0 (pixels_size)) == NULL) ++ { ++ g_free (pixels); ++ continue; ++ } + + if (! TIFFGetField (tif, TIFFTAG_XPOSITION, &x_pos)) + x_pos = 0.0f; +@@ -2481,7 +2498,6 @@ load_sketchbook_layers (TIFF *tif, + gimp_image_insert_layer (image, layer, NULL, -1); + + /* Loading pixel data */ +- pixels = g_new (uint32_t, layer_width * layer_height); + if (! TIFFReadRGBAImage (tif, layer_width, layer_height, pixels, 0)) + { + g_free (pixels); diff -Nru gimp-3.0.4/debian/patches/CVE-2026-42170.patch gimp-3.0.4/debian/patches/CVE-2026-42170.patch --- gimp-3.0.4/debian/patches/CVE-2026-42170.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-42170.patch 2026-08-21 16:40:54.000000000 +0000 @@ -0,0 +1,29 @@ +From 7dff816fbd58fe17456405f19db332ef5d2a44a0 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Fri, 10 Apr 2026 02:27:51 +0000 +Subject: [PATCH] plug-in: Protect against invalid BPP in DDS import + +--- gimp-3.0.4.orig/plug-ins/file-dds/ddsread.c ++++ gimp-3.0.4/plug-ins/file-dds/ddsread.c +@@ -229,13 +229,18 @@ read_dds (GFile *file, + /* If format search was successful, get info needed to parse the file */ + if (load_info.d3d9_format || load_info.dxgi_format) + { ++ gint d3d9_bpp = 0; ++ gint dxgi_bpp = 0; ++ + load_info.read_info = get_format_read_info (load_info.d3d9_format, + load_info.dxgi_format); + +- if ((! hdr.pixelfmt.bpp) && load_info.d3d9_format) +- hdr.pixelfmt.bpp = get_bpp_d3d9 (load_info.d3d9_format); ++ if (load_info.d3d9_format) ++ d3d9_bpp = get_bpp_d3d9 (load_info.d3d9_format); + else if (load_info.dxgi_format) +- hdr.pixelfmt.bpp = get_bpp_dxgi (load_info.dxgi_format); ++ dxgi_bpp = get_bpp_dxgi (load_info.dxgi_format); ++ ++ hdr.pixelfmt.bpp = MAX (MAX (hdr.pixelfmt.bpp, d3d9_bpp), dxgi_bpp); + + /* Unset the FourCC flag as D3D formats will be handled as uncompressed */ + if ((load_info.fmt_flags & DDPF_FOURCC) && load_info.d3d9_format) diff -Nru gimp-3.0.4/debian/patches/CVE-2026-58379.patch gimp-3.0.4/debian/patches/CVE-2026-58379.patch --- gimp-3.0.4/debian/patches/CVE-2026-58379.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-58379.patch 2026-08-21 17:45:14.000000000 +0000 @@ -0,0 +1,49 @@ +From b630f167ba7b73b17e7dd6df1fee1623f8324575 Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Wed, 22 Apr 2026 11:09:36 -0400 +Subject: [PATCH] plug-ins: Fix #16205 PSP File Parsing Heap Buffer Overflow + +--- gimp-3.0.4.orig/plug-ins/common/file-psp.c ++++ gimp-3.0.4/plug-ins/common/file-psp.c +@@ -1540,7 +1540,7 @@ upscale_indexed_sub_8 (FILE *f, + guchar *tmpbuf, *buf_start, *src; + + /* Scanlines for 1 and 4 bit only end on a 4-byte boundary. */ +- line_width = (((width * bpp + 7) / 8) + bpp_zero_based) / 4 * 4; ++ line_width = (((width * bpp + 7) / 8) + 3) / 4 * 4; + buf_start = g_malloc0 (width * height); + tmpbuf = buf_start; + +@@ -1586,7 +1586,7 @@ read_channel_data (FILE *f, + if (ia->depth < 8) + { + /* Scanlines for 1 and 4 bit only end on a 4-byte boundary. */ +- line_width = (((width * ia->depth + 7) / 8) + ia->depth - 1) / 4 * 4; ++ line_width = ((width * ia->depth + 7) / 8 + 3) / 4 * 4; + } + else + { +@@ -1609,12 +1609,12 @@ read_channel_data (FILE *f, + { + guchar *p, *q; + +- fread (buf, width, 1, f); ++ fread (buf, line_width, 1, f); + /* Contrary to what the PSP specification seems to suggest + scanlines are not stored on a 4-byte boundary. */ + p = buf; + q = pixels[y] + offset; +- for (i = 0; i < width; i++) ++ for (i = 0; i < line_width; i++) + { + *q = *p++; + q += bytespp; +@@ -2107,7 +2107,7 @@ read_layer_block (FILE *f, + + if (ia->depth < 8) + { +- gint min_line_width = (((width * ia->depth + 7) / 8) + (ia->depth - 1)) / 4 * 4; ++ gint min_line_width = (((width * ia->depth + 7) / 8) + 3) / 4 * 4; + + /* For small widths, when depth is 1, or 4, the number of bytes + * used can be larger than the width * bytespp. Adjust for that. */ diff -Nru gimp-3.0.4/debian/patches/CVE-2026-58380.patch gimp-3.0.4/debian/patches/CVE-2026-58380.patch --- gimp-3.0.4/debian/patches/CVE-2026-58380.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-58380.patch 2026-08-21 17:46:10.000000000 +0000 @@ -0,0 +1,16 @@ +From 8369981756fc2742226b79296fd1886156001d94 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 11 Apr 2026 14:33:42 +0000 +Subject: [PATCH] plug-ins: Boost buffer size for pnmscanner_gettoken + +--- gimp-3.0.4.orig/plug-ins/common/file-pnm.c ++++ gimp-3.0.4/plug-ins/common/file-pnm.c +@@ -955,7 +955,7 @@ pnm_load_ascii (PNMScanner *scan, + gint x, y, i, b; + gint start, end, scanlines; + gint np; +- gchar buf[BUFLEN]; ++ gchar buf[BUFLEN + 4]; + gboolean aborted = FALSE; + + np = (info->np) ? (info->np) : 1; diff -Nru gimp-3.0.4/debian/patches/CVE-2026-58381.patch gimp-3.0.4/debian/patches/CVE-2026-58381.patch --- gimp-3.0.4/debian/patches/CVE-2026-58381.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-58381.patch 2026-08-21 17:47:07.000000000 +0000 @@ -0,0 +1,60 @@ +From b22e147b9dac6a57c50f3162262aa18fa1b1e210 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 11 Apr 2026 14:10:16 +0000 +Subject: [PATCH] plug-ins: Prevent double-freeing PSP layer name + +--- gimp-3.0.4.orig/plug-ins/common/file-psp.c ++++ gimp-3.0.4/plug-ins/common/file-psp.c +@@ -1884,7 +1884,7 @@ read_layer_block (FILE *f, + + while (ftell (f) < block_start + total_len) + { +- null_layer = FALSE; ++ null_layer = FALSE; + can_handle_layer = FALSE; + + /* Read the layer sub-block header */ +@@ -1905,6 +1905,8 @@ read_layer_block (FILE *f, + /* Read layer information chunk */ + if (psp_ver_major >= 4) + { ++ name = NULL; ++ + if (fread (&chunk_len, 4, 1, f) < 1 + || fread (&namelen, 2, 1, f) < 1 + /* A zero length layer name is apparently valid. To not get a warning for +@@ -1927,12 +1929,14 @@ read_layer_block (FILE *f, + { + g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, + _("Error reading layer information chunk")); ++ + g_free (name); + return NULL; + } + + name[namelen] = 0; +- layer_name = g_convert (name, -1, "utf-8", "iso8859-1", NULL, NULL, NULL); ++ layer_name = g_convert (name, -1, "utf-8", "iso8859-1", NULL, NULL, ++ NULL); + g_free (name); + + chunk_len = GUINT32_FROM_LE (chunk_len); +@@ -1962,7 +1966,7 @@ read_layer_block (FILE *f, + } + else + { +- name = g_malloc (257); ++ name = g_malloc (257); + name[256] = 0; + + if (fread (name, 256, 1, f) < 1 +@@ -1987,7 +1991,8 @@ read_layer_block (FILE *f, + g_free (name); + return NULL; + } +- layer_name = g_convert (name, -1, "utf-8", "iso8859-1", NULL, NULL, NULL); ++ layer_name = g_convert (name, -1, "utf-8", "iso8859-1", NULL, NULL, ++ NULL); + g_free (name); + if (type == PSP_LAYER_FLOATING_SELECTION) + g_message ("Floating selection restored as normal layer"); diff -Nru gimp-3.0.4/debian/patches/CVE-2026-58384.patch gimp-3.0.4/debian/patches/CVE-2026-58384.patch --- gimp-3.0.4/debian/patches/CVE-2026-58384.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-58384.patch 2026-08-21 18:17:46.000000000 +0000 @@ -0,0 +1,34 @@ +From da29e21779a851fcd95d2af29294bee4071a67a7 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 11 Apr 2026 17:41:50 +0000 +Subject: [PATCH] plug-ins: Guard against too large PSD channel sizes + +--- gimp-3.0.4.orig/plug-ins/file-psd/psd-load.c ++++ gimp-3.0.4/plug-ins/file-psd/psd-load.c +@@ -1790,6 +1790,7 @@ read_RLE_channel (PSDimage *img_a, + { + gint rle_count_size = (img_a->version == 1 ? 2 : 4); + gint rle_row_size = lyr_chn->rows * rle_count_size; ++ gsize row_allocation; + guint32 *rle_pack_len; + gint rowi; + +@@ -1799,7 +1800,17 @@ read_RLE_channel (PSDimage *img_a, + channel_data_len - 2, + rle_row_size, + (channel_data_len - 2 - rle_row_size)); +- rle_pack_len = g_malloc (lyr_chn->rows * 4); /* Always 4 since this is the data size in memory. */ ++ ++ /* Always 4 since this is the data size in memory. */ ++ if (! g_size_checked_mul (&row_allocation, lyr_chn->rows, 4) || ++ row_allocation >= G_MAXUINT32) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Unsupported or invalid channel size")); ++ return FALSE; ++ } ++ ++ rle_pack_len = g_malloc ((guint32) row_allocation); + for (rowi = 0; rowi < lyr_chn->rows; ++rowi) + { + if (psd_read (input, &rle_pack_len[rowi], rle_count_size, diff -Nru gimp-3.0.4/debian/patches/CVE-2026-59088.patch gimp-3.0.4/debian/patches/CVE-2026-59088.patch --- gimp-3.0.4/debian/patches/CVE-2026-59088.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-59088.patch 2026-08-21 18:54:01.000000000 +0000 @@ -0,0 +1,78 @@ +From 1db4690bde3a349df046f85a4ee9a71af8492216 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Tue, 16 Jun 2026 02:13:03 +0000 +Subject: [PATCH] plug-ins: Mitigate issue #16492 + +--- gimp-3.0.4.orig/plug-ins/file-fli/fli-gimp.c ++++ gimp-3.0.4/plug-ins/file-fli/fli-gimp.c +@@ -542,8 +542,17 @@ load_image (GFile *file, + + image = gimp_image_new (fli_header.width, fli_header.height, GIMP_INDEXED); + +- fb = g_malloc (fli_header.width * fli_header.height); +- ofb = g_malloc (fli_header.width * fli_header.height); ++ fb = g_try_malloc ((gsize) fli_header.width * fli_header.height); ++ ofb = g_try_malloc ((gsize) fli_header.width * fli_header.height); ++ if (! fb || ! ofb) ++ { ++ g_set_error (error, G_FILE_ERROR, 0, ++ _("Memory could not be allocated.")); ++ fclose (fp); ++ g_free (fb); ++ g_free (ofb); ++ return FALSE; ++ } + + /* + * Skip to the beginning of requested frames: +@@ -802,8 +811,17 @@ export_image (GFile *file, + } + fseek (fp, 128, SEEK_SET); + +- fb = g_malloc (fli_header.width * fli_header.height); +- ofb = g_malloc (fli_header.width * fli_header.height); ++ fb = g_try_malloc ((gsize) fli_header.width * fli_header.height); ++ ofb = g_try_malloc ((gsize) fli_header.width * fli_header.height); ++ if (! fb || ! ofb) ++ { ++ g_set_error (error, G_FILE_ERROR, 0, ++ _("Memory could not be allocated.")); ++ fclose (fp); ++ g_free (fb); ++ g_free (ofb); ++ return FALSE; ++ } + + /* initialize with bg color */ + memset (fb, bg, fli_header.width * fli_header.height); +--- gimp-3.0.4.orig/plug-ins/file-fli/fli.c ++++ gimp-3.0.4/plug-ins/file-fli/fli.c +@@ -883,7 +883,7 @@ fli_read_black (FILE *f, + guchar *framebuf, + GError **error) + { +- memset (framebuf, 0, fli_header->width * fli_header->height); ++ memset (framebuf, 0, (gsize) fli_header->width * fli_header->height); + + return TRUE; + } +@@ -1178,7 +1178,8 @@ fli_read_lc (FILE *f, + gushort yc, firstline, numline; + guchar *pos; + +- memcpy (framebuf, old_framebuf, fli_header->width * fli_header->height); ++ memcpy (framebuf, old_framebuf, ++ (gint64) fli_header->width * fli_header->height); + + if (! fli_read_short (f, &firstline, error) || + ! fli_read_short (f, &numline, error)) +@@ -1432,7 +1433,8 @@ fli_read_lc_2 (FILE *f, + guchar *pos; + guint32 len_read; + +- memcpy (framebuf, old_framebuf, fli_header->width * fli_header->height); ++ memcpy (framebuf, old_framebuf, ++ (gint64) fli_header->width * fli_header->height); + yc = 0; + + if (! fli_read_short (f, &numline, error)) diff -Nru gimp-3.0.4/debian/patches/CVE-2026-59090.patch gimp-3.0.4/debian/patches/CVE-2026-59090.patch --- gimp-3.0.4/debian/patches/CVE-2026-59090.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-59090.patch 2026-08-21 18:54:54.000000000 +0000 @@ -0,0 +1,74 @@ +From 612c7e0a5775e7883789022c61f85a1c82c05505 Mon Sep 17 00:00:00 2001 +From: Jacob Boerema +Date: Tue, 30 Jun 2026 15:50:17 -0400 +Subject: [PATCH] plug-ins: mitigate issue #16509 + +--- gimp-3.0.4.orig/plug-ins/file-psd/psd-load.c ++++ gimp-3.0.4/plug-ins/file-psd/psd-load.c +@@ -1000,6 +1000,16 @@ read_layer_info (PSDimage *img_a, + return NULL; + } + ++ if (block_len + 4 > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) block_len); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } ++ + block_rem -= (block_len + 4); + IFDBG(3) g_debug ("Offset: %" G_GOFFSET_FORMAT ", Remaining length %" G_GSIZE_FORMAT, + PSD_TELL(input), block_rem); +@@ -1238,6 +1248,16 @@ read_layer_info (PSDimage *img_a, + return NULL; + } + ++ if (read_len > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) read_len); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } ++ + block_rem -= read_len; + IFDBG(3) g_debug ("Offset: %" G_GOFFSET_FORMAT ", Remaining length %" G_GSIZE_FORMAT, + PSD_TELL(input), block_rem); +@@ -1258,6 +1278,15 @@ read_layer_info (PSDimage *img_a, + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } ++ if (header_size > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, (gsize) header_size); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } + + block_rem -= header_size; + +@@ -1286,6 +1315,16 @@ read_layer_info (PSDimage *img_a, + free_lyr_a (lyr_a, img_a->num_layers); + return NULL; + } ++ if (res_a.data_len > block_rem) ++ { ++ g_set_error (error, G_FILE_ERROR, G_FILE_ERROR_FAILED, ++ _("Invalid block size.")); ++ /* Translations have problems with using G_GSIZE_FORMAT, let's use g_debug. */ ++ g_debug ("Invalid block size: %" G_GSIZE_FORMAT, res_a.data_len); ++ free_lyr_a (lyr_a, img_a->num_layers); ++ return NULL; ++ } ++ + block_rem -= res_a.data_len; + IFDBG(3) g_debug ("Remaining length in block: %" G_GSIZE_FORMAT, block_rem); + } diff -Nru gimp-3.0.4/debian/patches/CVE-2026-66758.patch gimp-3.0.4/debian/patches/CVE-2026-66758.patch --- gimp-3.0.4/debian/patches/CVE-2026-66758.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-66758.patch 2026-08-21 19:01:30.000000000 +0000 @@ -0,0 +1,23 @@ +From 89ae907fea5ccc8bd1f626dbe01fdcfe29940ac9 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sun, 28 Jun 2026 12:58:47 +0000 +Subject: [PATCH] plug-ins: Mitigate overflow in FITS import + +--- gimp-3.0.4.orig/plug-ins/file-fits/fits.c ++++ gimp-3.0.4/plug-ins/file-fits/fits.c +@@ -490,11 +490,11 @@ load_image (GFile *file, + /* If RGB FITS image, we need to read in the whole image so we can + * convert the planes format to RGB */ + if (hdu.naxis == 2) +- pixels = +- (gdouble *) g_try_malloc (width * sizeof (gdouble) * channels); ++ pixels = (gdouble *) g_try_malloc ((gsize) width * sizeof (gdouble) * ++ channels); + else +- pixels = +- (gdouble *) g_try_malloc (width * height * sizeof (gdouble) * channels); ++ pixels = (gdouble *) g_try_malloc ((gsize) width * height * ++ sizeof (gdouble) * channels); + + if (pixels == NULL) + { diff -Nru gimp-3.0.4/debian/patches/CVE-2026-66759.patch gimp-3.0.4/debian/patches/CVE-2026-66759.patch --- gimp-3.0.4/debian/patches/CVE-2026-66759.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-66759.patch 2026-08-21 19:02:44.000000000 +0000 @@ -0,0 +1,38 @@ +From abb3129a8ecb79bf3af6df03bc35ddf8f7aaba20 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Tue, 7 Jul 2026 15:54:40 +0000 +Subject: [PATCH] plug-ins: Mitigate OOB write on ICNS mask data + +--- gimp-3.0.4.orig/plug-ins/file-icns/file-icns-load.c ++++ gimp-3.0.4/plug-ins/file-icns/file-icns-load.c +@@ -341,7 +341,7 @@ icns_decompress (guchar *dest, + { + if (out >= max) + { +- g_message ("Corrupt icon? compressed run overflows output size."); ++ g_message ("Corrupt icon: compressed run overflows output size."); + return FALSE; + } + dest[out++ * 4 + channel] = val; +@@ -387,10 +387,19 @@ icns_decompress (guchar *dest, + else if (mask) + { + gchar typestring[5]; +- fourcc_get_string (mask->type, typestring); + ++ fourcc_get_string (mask->type, typestring); + for (out = 0; out < max; out++) +- dest[out * 4 + 3] = mask->data[mask->cursor++]; ++ { ++ if (mask->cursor >= mask->size) ++ { ++ g_message ("Corrupt icon mask: uncompressed run overflows input " ++ "size."); ++ return FALSE; ++ } ++ ++ dest[out * 4 + 3] = mask->data[mask->cursor++]; ++ } + } + return TRUE; + } diff -Nru gimp-3.0.4/debian/patches/series gimp-3.0.4/debian/patches/series --- gimp-3.0.4/debian/patches/series 2026-06-10 07:56:39.000000000 +0000 +++ gimp-3.0.4/debian/patches/series 2026-08-21 19:02:35.000000000 +0000 @@ -26,3 +26,20 @@ 0001-plug-in-Resolve-ZDI-CAN-28901-for-file-xpm.patch 0002-plug-ins-Protect-against-too-large-FITS-images.patch +CVE-2026-18301.patch +CVE-2026-18302.patch +CVE-2026-18303.patch +CVE-2026-18304.patch +CVE-2026-18305.patch +CVE-2026-18306.patch +CVE-2026-18307.patch +CVE-2026-18308.patch +CVE-2026-42170.patch +CVE-2026-58379.patch +CVE-2026-58380.patch +CVE-2026-58381.patch +CVE-2026-58384.patch +CVE-2026-59088.patch +CVE-2026-59090.patch +CVE-2026-66758.patch +CVE-2026-66759.patch