Security update for gimp
This update for gimp fixes the following issues: - CVE-2026-18301: Vulnerability Report at read_channel_data (bsc#1276230). - CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow (bsc#1276231). - CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow (bsc#1276232). - CVE-2026-18304: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276233). - CVE-2026-18305: TIF File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276234). - CVE-2026-18306: SGI File Parsing Integer Overflow Remote Code Execution Vulnerability (bsc#1276235). - CVE-2026-18307: File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (bsc#1276236). - CVE-2026-90947: out-of-bounds write in the lighting effects plugin when processing a crafted preset file due to improper validation of the number of light sources (bsc#1280511). - CVE-2026-90948: heap buffer overflow in the ICO loader when processing ICO files with embedded PNG images due to an integer overflow during calculation of buffer sizes (bsc#1280512). - CVE-2026-92248: integer overflow when generating a thumbnail preview for a PSD file can lead to a heap buffer overflow (bsc#1280739).
SUSE-SU-2026:4409-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:SUSE-SU-2026:4409-1
gimp
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.10.30-150400.3.79.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
gimp
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 2.10.30-150400.3.79.1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.30-150400.3.79.1"
}
]
}
],
"package": {
"name": "gimp",
"purl": "pkg:rpm/suse/gimp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Package Hub 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4409-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"gimp": "2.10.30-150400.3.79.1",
"gimp-lang": "2.10.30-150400.3.79.1",
"gimp-devel": "2.10.30-150400.3.79.1",
"libgimp-2_0-0": "2.10.30-150400.3.79.1",
"gimp-plugin-aa": "2.10.30-150400.3.79.1",
"libgimpui-2_0-0": "2.10.30-150400.3.79.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.30-150400.3.79.1"
}
]
}
],
"package": {
"name": "gimp",
"purl": "pkg:rpm/suse/gimp&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Workstation Extension 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4409-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"gimp": "2.10.30-150400.3.79.1",
"gimp-lang": "2.10.30-150400.3.79.1",
"gimp-devel": "2.10.30-150400.3.79.1",
"libgimp-2_0-0": "2.10.30-150400.3.79.1",
"libgimpui-2_0-0": "2.10.30-150400.3.79.1"
}
]
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #62476 · Revision 1
- Added to Heist Feed
- Publisher date