Version in base suite: 3.0.4-3+deb13u10 Base version: gimp_3.0.4-3+deb13u10 Target version: gimp_3.0.4-3+deb13u11 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gimp/gimp_3.0.4-3+deb13u10.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gimp/gimp_3.0.4-3+deb13u11.dsc changelog | 11 +++ patches/CVE-2026-78465.patch | 107 +++++++++++++++++++++++++++++ patches/CVE-2026-78475.patch | 51 ++++++++++++++ patches/CVE-2026-82328.patch | 31 ++++++++ patches/CVE-2026-90947.patch | 26 +++++++ patches/CVE-2026-90948.patch | 156 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-92248.patch | 82 ++++++++++++++++++++++ patches/series | 6 + 8 files changed, 470 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpzmkasifh/gimp_3.0.4-3+deb13u10.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpzmkasifh/gimp_3.0.4-3+deb13u11.dsc: no acceptable signature found diff -Nru gimp-3.0.4/debian/changelog gimp-3.0.4/debian/changelog --- gimp-3.0.4/debian/changelog 2026-08-21 19:03:47.000000000 +0000 +++ gimp-3.0.4/debian/changelog 2026-09-19 15:17:20.000000000 +0000 @@ -1,3 +1,14 @@ +gimp (3.0.4-3+deb13u11) trixie-security; urgency=medium + + * CVE-2026-92248 + * CVE-2026-90947 + * CVE-2026-82328 (Closes: #1146133) + * CVE-2026-90948 + * CVE-2026-78465 (Closes: #1145875) + * CVE-2026-78475 (Closes: #1145874) + + -- Moritz Mühlenhoff Sat, 19 Sep 2026 17:17:20 +0200 + gimp (3.0.4-3+deb13u10) trixie-security; urgency=medium * CVE-2026-18301 diff -Nru gimp-3.0.4/debian/patches/CVE-2026-78465.patch gimp-3.0.4/debian/patches/CVE-2026-78465.patch --- gimp-3.0.4/debian/patches/CVE-2026-78465.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-78465.patch 2026-09-19 15:16:39.000000000 +0000 @@ -0,0 +1,107 @@ +From 56e580c43a2de9c0005f57018013998999535e4d Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Sat, 15 Aug 2026 18:43:19 +0000 +Subject: [PATCH] plug-ins: Guard 32-bit builds of PCX plug-in + +--- gimp-3.0.4.orig/plug-ins/common/file-pcx.c ++++ gimp-3.0.4/plug-ins/common/file-pcx.c +@@ -637,6 +637,7 @@ load_image (GimpProcedure *procedure, + GimpImage *image; + GimpLayer *layer; + guchar *dest, cmap[768]; ++ gsize allocation = 0; + guint8 header_buf[128]; + gboolean override_palette = FALSE; + +@@ -696,7 +697,8 @@ load_image (GimpProcedure *procedure, + } + + /* Shield against potential buffer overflows in load_*() functions. */ +- if (G_MAXSIZE / width / height < 3) ++ if (G_MAXSIZE / width / height < 3 || ++ ! g_size_checked_mul (&allocation, width, height)) + { + g_set_error (error, GIMP_PLUG_IN_ERROR, 0, + _("Image dimensions too large: width %d x height %d"), +@@ -739,7 +741,8 @@ load_image (GimpProcedure *procedure, + if (pcx_header.planes == 1 && pcx_header.bpp == 1) + { + const guint8 *colormap = pcx_header.colormap; +- dest = g_new (guchar, ((gsize) width) * height); ++ ++ dest = g_new0 (guchar, allocation); + load_1 (fd, width, height, dest, bytesperline); + + if (run_mode == GIMP_RUN_INTERACTIVE) +@@ -782,7 +785,7 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 1 && pcx_header.planes == 2) + { +- dest = g_new (guchar, ((gsize) width) * height); ++ dest = g_new0 (guchar, allocation); + load_sub_8 (fd, width, height, 1, 2, dest, bytesperline); + gimp_palette_set_colormap (gimp_image_get_palette (image), + babl_format ("R'G'B' u8"), +@@ -790,7 +793,7 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 2 && pcx_header.planes == 1) + { +- dest = g_new (guchar, ((gsize) width) * height); ++ dest = g_new0 (guchar, allocation); + load_sub_8 (fd, width, height, 2, 1, dest, bytesperline); + gimp_palette_set_colormap (gimp_image_get_palette (image), + babl_format ("R'G'B' u8"), +@@ -798,7 +801,7 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 1 && pcx_header.planes == 3) + { +- dest = g_new (guchar, ((gsize) width) * height); ++ dest = g_new0 (guchar, allocation); + load_sub_8 (fd, width, height, 1, 3, dest, bytesperline); + gimp_palette_set_colormap (gimp_image_get_palette (image), + babl_format ("R'G'B' u8"), +@@ -806,7 +809,7 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 1 && pcx_header.planes == 4) + { +- dest = g_new (guchar, ((gsize) width) * height); ++ dest = g_new0 (guchar, allocation); + load_4 (fd, width, height, dest, bytesperline); + gimp_palette_set_colormap (gimp_image_get_palette (image), + babl_format ("R'G'B' u8"), +@@ -814,7 +817,7 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 4 && pcx_header.planes == 1) + { +- dest = g_new (guchar, ((gsize) width) * height); ++ dest = g_new0 (guchar, allocation); + load_sub_8 (fd, width, height, 4, 1, dest, bytesperline); + gimp_palette_set_colormap (gimp_image_get_palette (image), + babl_format ("R'G'B' u8"), +@@ -822,7 +825,7 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 8 && pcx_header.planes == 1) + { +- dest = g_new (guchar, ((gsize) width) * height); ++ dest = g_new0 (guchar, allocation); + load_8 (fd, width, height, dest, bytesperline); + fseek (fd, -768L, SEEK_END); + fread (cmap, 768, 1, fd); +@@ -832,7 +835,16 @@ load_image (GimpProcedure *procedure, + } + else if (pcx_header.bpp == 8 && (pcx_header.planes == 3 || pcx_header.planes == 4)) + { +- dest = g_new (guchar, ((gsize) width) * height * pcx_header.planes); ++ if (! g_size_checked_mul (&allocation, allocation, pcx_header.planes)) ++ { ++ g_set_error (error, GIMP_PLUG_IN_ERROR, 0, ++ _("Image dimensions too large: width %d x height %d"), ++ width, height); ++ g_object_unref (buffer); ++ return NULL; ++ } ++ ++ dest = g_new0 (guchar, allocation); + load_24 (fd, width, height, dest, bytesperline, pcx_header.planes); + } + else diff -Nru gimp-3.0.4/debian/patches/CVE-2026-78475.patch gimp-3.0.4/debian/patches/CVE-2026-78475.patch --- gimp-3.0.4/debian/patches/CVE-2026-78475.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-78475.patch 2026-09-19 15:17:14.000000000 +0000 @@ -0,0 +1,51 @@ +From 27d83534e637cf160f913ac6d6388d5a5555e9d8 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 15 Jul 2026 14:29:05 +0000 +Subject: [PATCH] plug-ins: Protect from overflowing VLA in ESM PIX + +--- gimp-3.0.4.orig/plug-ins/common/file-pix.c ++++ gimp-3.0.4/plug-ins/common/file-pix.c +@@ -554,7 +554,7 @@ load_esm_image (GInputStream *input, + + /* Esm Software PIX format is just a JPEG with an extra 21 byte header */ + temp_file = gimp_temp_file ("jpeg"); +- fp = g_fopen (g_file_peek_path (temp_file), "wb"); ++ fp = g_fopen (g_file_peek_path (temp_file), "wb"); + + if (! fp) + { +@@ -571,19 +571,32 @@ load_esm_image (GInputStream *input, + { + GimpProcedure *procedure; + GimpValueArray *return_vals; +- guchar buffer[file_size - 21]; ++ guchar *buffer; ++ ++ buffer = g_try_malloc0 (file_size - 21); ++ if (! buffer) ++ { ++ g_set_error (error, G_FILE_ERROR, 0, ++ "Memory could not be allocated."); ++ ++ fclose (fp); ++ return NULL; ++ } + +- if (! g_input_stream_read_all (input, buffer, sizeof (buffer), ++ if (! g_input_stream_read_all (input, buffer, (file_size - 21), + NULL, NULL, error)) + { + g_file_delete (temp_file, NULL, NULL); + g_object_unref (temp_file); + ++ g_free (buffer); ++ fclose (fp); + g_printerr (_("Invalid Esm Software PIX file")); + return NULL; + } + + fwrite (buffer, sizeof (guchar), file_size, fp); ++ g_free (buffer); + fclose (fp); + + procedure = gimp_pdb_lookup_procedure (gimp_get_pdb (), "file-jpeg-load"); diff -Nru gimp-3.0.4/debian/patches/CVE-2026-82328.patch gimp-3.0.4/debian/patches/CVE-2026-82328.patch --- gimp-3.0.4/debian/patches/CVE-2026-82328.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-82328.patch 2026-09-19 15:10:05.000000000 +0000 @@ -0,0 +1,31 @@ +From f59f677d849d5a2e1e689008d675f720c72e516e Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 15 Jul 2026 18:25:40 +0000 +Subject: [PATCH] plug-ins: Use BPP for ICO palette allocation + +--- gimp-3.0.4.orig/plug-ins/file-ico/ico-load.c ++++ gimp-3.0.4/plug-ins/file-ico/ico-load.c +@@ -493,13 +493,13 @@ ico_read_icon (FILE *fp, + + if (data.bpp <= 8) + { +- if (data.used_clrs == 0) ++ if (data.used_clrs == 0 || data.used_clrs > (1 << data.bpp)) + data.used_clrs = (1 << data.bpp); + + D((" allocating a %i-slot palette for %i bpp.\n", + data.used_clrs, data.bpp)); + +- palette = g_new0 (guint32, data.used_clrs); ++ palette = g_new0 (guint32, (1 << data.bpp)); + if (ico_read_int8 (fp, + (guint8 *) palette, + data.used_clrs * 4) != (data.used_clrs * 4)) +@@ -507,7 +507,6 @@ ico_read_icon (FILE *fp, + D(("skipping image: too large\n")); + return FALSE; + } +- + } + + xor_map = ico_alloc_map (w, h, data.bpp, &length); diff -Nru gimp-3.0.4/debian/patches/CVE-2026-90947.patch gimp-3.0.4/debian/patches/CVE-2026-90947.patch --- gimp-3.0.4/debian/patches/CVE-2026-90947.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-90947.patch 2026-09-19 15:08:55.000000000 +0000 @@ -0,0 +1,26 @@ +From 8a680c38fe84d529255e6b2916951ae7c480ed2c Mon Sep 17 00:00:00 2001 +From: Harsh Verma +Date: Tue, 18 Aug 2026 03:12:43 +0530 +Subject: [PATCH] plug-ins: fix out-of-bound write in lighting preset loader + +--- gimp-3.0.4.orig/plug-ins/lighting/lighting-ui.c ++++ gimp-3.0.4/plug-ins/lighting/lighting-ui.c +@@ -931,7 +931,7 @@ load_preset_response (GtkFileChooser *ch + gpointer data) + { + FILE *fp; +- gint num_lights; ++ gint num_lights = 0; + gint k; + LightSettings *source; + gchar buffer1[G_ASCII_DTOSTR_BUF_SIZE]; +@@ -956,6 +956,9 @@ load_preset_response (GtkFileChooser *ch + { + fscanf (fp, "Number of lights: %d", &num_lights); + ++ /* clamp to what the array can hold, don't trust the file */ ++ num_lights = CLAMP (num_lights, 0, NUM_LIGHTS); ++ + /* initialize lights to off */ + for (k = 0; k < NUM_LIGHTS; k++) + mapvals.lightsource[k].type = NO_LIGHT; diff -Nru gimp-3.0.4/debian/patches/CVE-2026-90948.patch gimp-3.0.4/debian/patches/CVE-2026-90948.patch --- gimp-3.0.4/debian/patches/CVE-2026-90948.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-90948.patch 2026-09-19 15:17:20.000000000 +0000 @@ -0,0 +1,156 @@ +From 07c8d365873dc748a11a2df19e7a9eeab1c10667 Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Wed, 9 Sep 2026 13:42:27 +0000 +Subject: [PATCH] plug-ins: Stop overflow when reading PNGs in ICO + +--- gimp-3.0.4.orig/plug-ins/file-ico/ico-load.c ++++ gimp-3.0.4/plug-ins/file-ico/ico-load.c +@@ -269,7 +269,7 @@ static gboolean + ico_read_png (FILE *fp, + guint32 header, + guchar *buf, +- gint maxsize, ++ gsize maxsize, + gint *width, + gint *height) + { +@@ -277,6 +277,7 @@ ico_read_png (FILE *fp, + png_infop info; + png_uint_32 w; + png_uint_32 h; ++ gsize total_size; + gint32 bit_depth; + gint32 color_type; + guint32 **rows; +@@ -304,15 +305,14 @@ ico_read_png (FILE *fp, + png_get_IHDR (png_ptr, info, &w, &h, &bit_depth, &color_type, + NULL, NULL, NULL); + /* Check for overflow */ +- if ((w * h * 4) < w || +- (w * h * 4) < h || +- (w * h * 4) < (w * h) || +- (w * h * 4) > maxsize) ++ if (! g_size_checked_mul (&total_size, w, h) || ++ ! g_size_checked_mul (&total_size, total_size, 4) || ++ total_size > maxsize) + { + png_destroy_read_struct (&png_ptr, &info, NULL); + return FALSE; + } +- D(("ico_read_png: %ix%i, %i bits, %i type\n", (gint)w, (gint)h, ++ D(("ico_read_png: %ix%i, %i bits, %i type\n", (gint) w, (gint) h, + bit_depth, color_type)); + switch (color_type) + { +@@ -347,12 +347,12 @@ ico_read_png (FILE *fp, + break; + } + +- *width = w; ++ *width = w; + *height = h; +- rows = g_new (guint32*, h); +- rows[0] = (guint32*) buf; ++ rows = g_new (guint32 *, h); ++ rows[0] = (guint32 *) buf; + for (i = 1; i < h; i++) +- rows[i] = rows[i-1] + w; ++ rows[i] = rows[i - 1] + w; + png_read_image (png_ptr, (png_bytepp) rows); + png_destroy_read_struct (&png_ptr, &info, NULL); + g_free (rows); +@@ -425,7 +425,7 @@ static gboolean + ico_read_icon (FILE *fp, + guint32 header_size, + guchar *buf, +- gint maxsize, ++ gsize maxsize, + gint *width, + gint *height) + { +@@ -635,7 +635,7 @@ ico_load_layer (FILE *fp, + GimpImage *image, + gint32 icon_num, + guchar *buf, +- gint maxsize, ++ gsize maxsize, + gint32 file_offset, + gchar *layer_prefix, + IcoLoadInfo *info) +@@ -651,7 +651,7 @@ ico_load_layer (FILE *fp, + + if (first_bytes == ICO_PNG_MAGIC) + { +- if (!ico_read_png (fp, first_bytes, buf, maxsize, &width, &height)) ++ if (! ico_read_png (fp, first_bytes, buf, maxsize, &width, &height)) + return NULL; + } + else if (first_bytes == 40) +@@ -690,12 +690,13 @@ ico_load_image (GFile *file, + FILE *fp; + IcoFileHeader header; + IcoLoadInfo *info; +- gint max_width, max_height; ++ gsize max_width; ++ gsize max_height; + gint i; + GimpImage *image; + guchar *buf; + guint icon_count; +- gint maxsize; ++ gsize maxsize; + gchar *str; + + if (! file_offset) +@@ -715,7 +716,7 @@ ico_load_image (GFile *file, + if (file_offset) + fseek (fp, *file_offset, SEEK_SET); + +- header = ico_read_init (fp); ++ header = ico_read_init (fp); + icon_count = header.icon_count; + if (!icon_count) + { +@@ -740,7 +741,9 @@ ico_load_image (GFile *file, + if (info[i].height > max_height) + max_height = info[i].height; + } +- if (max_width <= 0 || max_height <= 0) ++ if (max_width <= 0 || max_height <= 0 || ++ max_width > GIMP_MAX_IMAGE_SIZE || ++ max_height > GIMP_MAX_IMAGE_SIZE) + { + g_free (info); + fclose (fp); +@@ -750,9 +753,18 @@ ico_load_image (GFile *file, + + image = gimp_image_new (max_width, max_height, GIMP_RGB); + +- maxsize = max_width * max_height * 4; +- buf = g_try_new (guchar, maxsize); +- if (! buf) ++ if (max_width <= 0 || max_height <= 0 || ++ max_width > GIMP_MAX_IMAGE_SIZE || ++ max_height > GIMP_MAX_IMAGE_SIZE) ++ { ++ g_free (info); ++ fclose (fp); ++ return NULL; ++ } ++ ++ if (! g_size_checked_mul (&maxsize, max_width, max_height) || ++ ! g_size_checked_mul (&maxsize, maxsize, 4) || ++ ! (buf = g_try_new (guchar, maxsize))) + { + g_free (info); + fclose (fp); +@@ -806,6 +818,9 @@ ico_load_image (GFile *file, + gimp_item_attach_parasite (GIMP_ITEM (layer), parasite); + gimp_parasite_free (parasite); + } ++ ++ if (! file_offset) ++ gimp_progress_update (i / (gfloat) icon_count); + } + + if (file_offset) diff -Nru gimp-3.0.4/debian/patches/CVE-2026-92248.patch gimp-3.0.4/debian/patches/CVE-2026-92248.patch --- gimp-3.0.4/debian/patches/CVE-2026-92248.patch 1970-01-01 00:00:00.000000000 +0000 +++ gimp-3.0.4/debian/patches/CVE-2026-92248.patch 2026-09-19 15:08:17.000000000 +0000 @@ -0,0 +1,82 @@ +From 6b1e668699ebebc35152ad6c3db4b445cd78b7df Mon Sep 17 00:00:00 2001 +From: Alx Sa +Date: Tue, 15 Sep 2026 11:05:37 +0000 +Subject: [PATCH] plug-ins: Add bounds checks for PSD thumbnail + +--- gimp-3.0.4.orig/plug-ins/file-psd/psd-image-res-load.c ++++ gimp-3.0.4/plug-ins/file-psd/psd-image-res-load.c +@@ -998,20 +998,22 @@ load_resource_1033 (const PSDimageres * + { + /* Load thumbnail image */ + +- struct jpeg_decompress_struct cinfo; +- struct jpeg_error_mgr jerr; ++ struct jpeg_decompress_struct cinfo; ++ struct jpeg_error_mgr jerr; + +- FILE *f; +- ThumbnailInfo thumb_info; +- GeglBuffer *buffer; +- const Babl *format; +- GimpLayer *layer; +- guchar *buf; +- guchar *rgb_buf; +- guchar **rowbuf; +- gint i; ++ FILE *f; ++ ThumbnailInfo thumb_info; ++ GeglBuffer *buffer; ++ const Babl *format; ++ GimpLayer *layer; ++ guchar *buf; ++ guchar *rgb_buf; ++ guchar **rowbuf; ++ gsize alloc = 0; ++ gint i; + +- IFDBG(2) g_debug ("Process image resource block %d: Thumbnail Image", res_a->id); ++ IFDBG(2) g_debug ("Process image resource block %d: Thumbnail Image", ++ res_a->id); + + /* Read thumbnail resource header info */ + if (psd_read (input, &thumb_info.format, 4, error) < 4 || +@@ -1057,14 +1059,14 @@ load_resource_1033 (const PSDimageres * + return -1; + + /* Now seek to the same position as we have in input. */ +- fseek(f, g_seekable_tell (G_SEEKABLE (input)), SEEK_SET); ++ fseek (f, g_seekable_tell (G_SEEKABLE (input)), SEEK_SET); + + /* Step 1: Allocate and initialize JPEG decompression object */ + cinfo.err = jpeg_std_error (&jerr); + jpeg_create_decompress (&cinfo); + + /* Step 2: specify data source (eg, a file) */ +- jpeg_stdio_src(&cinfo, f); ++ jpeg_stdio_src (&cinfo, f); + + /* Step 3: read file parameters with jpeg_read_header() */ + jpeg_read_header (&cinfo, TRUE); +@@ -1076,11 +1078,18 @@ load_resource_1033 (const PSDimageres * + jpeg_start_decompress (&cinfo); + + /* temporary buffers */ +- buf = g_new (guchar, cinfo.output_height * cinfo.output_width +- * cinfo.output_components); ++ if (cinfo.output_width > GIMP_MAX_IMAGE_SIZE || ++ cinfo.output_height > GIMP_MAX_IMAGE_SIZE || ++ ! g_size_checked_mul (&alloc, cinfo.output_height, cinfo.output_width) || ++ ! g_size_checked_mul (&alloc, alloc, cinfo.output_components) || ++ ! (buf = g_try_new0 (guchar, alloc))) ++ { ++ psd_set_error (error); ++ return -1; ++ } ++ + if (res_a->id == PSD_THUMB_RES) +- rgb_buf = g_new (guchar, cinfo.output_height * cinfo.output_width +- * cinfo.output_components); ++ rgb_buf = g_try_new0 (guchar, alloc); + else + rgb_buf = NULL; + rowbuf = g_new (guchar *, cinfo.output_height); diff -Nru gimp-3.0.4/debian/patches/series gimp-3.0.4/debian/patches/series --- gimp-3.0.4/debian/patches/series 2026-08-21 19:02:35.000000000 +0000 +++ gimp-3.0.4/debian/patches/series 2026-09-19 15:16:59.000000000 +0000 @@ -43,3 +43,9 @@ CVE-2026-59090.patch CVE-2026-66758.patch CVE-2026-66759.patch +CVE-2026-92248.patch +CVE-2026-90947.patch +CVE-2026-82328.patch +CVE-2026-90948.patch +CVE-2026-78465.patch +CVE-2026-78475.patch