[From nobody Sat Jun 27 09:09:07 2026
Received: (at 1132846-done) by bugs.debian.org; 27 Jun 2026 08:06:47 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-110.8 required=4.0 tests=BAYES_00,DKIMWL_WL_HIGH,
 DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,
 FROMDEVELOPER,HAS_BUG_NUMBER,MD5_SHA1_SUM,RCVD_IN_DNSWL_MED,
 SPF_HELO_NONE,SPF_SOFTFAIL,USER_IN_DKIM_WELCOMELIST,VERSION
 autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 47; hammy, 149; neutral, 90; spammy,
 1. spammytokens:0.998-1--youth hammytokens:0.000-+--H*Ad:D*vinc17.net,
 0.000-+--H*Ad:N*Gevers, 0.000-+--H*Ad:N*Bastian, 0.000-+--H*r:SHA384,
 0.000-+--H*F:N*Bastian
Return-path: <waldi@debian.org>
Received: from s3.thinkmo.de ([162.55.237.202]:60176 helo=mail.thinkmo.de)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <waldi@debian.org>) id 1wdO3q-00ByJJ-38
 for 1132846-done@bugs.debian.org; Sat, 27 Jun 2026 08:06:47 +0000
Received: from localhost (localhost [127.0.0.1])
 by mail.thinkmo.de (Postfix) with ESMTP id 4gnQ9b1Xh5zycP;
 Sat, 27 Jun 2026 08:06:43 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=debian.org; h=
 in-reply-to:content-disposition:content-type:content-type
 :mime-version:references:message-id:subject:subject:from:from
 :date:date:received:received; s=mail202007.waldi.user; t=
 1782547603; bh=+FMMwPK3E35fM6zBw/E5BIsS5rUkxJXtaL7ok2uWQrc=; b=G
 W9RdN5fayP/0O8YdkZzNUb/10/1Hpiou5LatQ22I6xohwcoK5XS7Nr0HXSoGe9VK
 ekCq6VZeSls3bXVgj1gcnTv2rP+X1/Z4Dsjm+FxWb82A77pA7yAaTS8QU4QcDWrg
 bLO/KrWmBKnLU0ZbyjbolOlsD7homMYEnsyDTMzlpghBcSHSi/2e8l78S8wsxs4h
 VzWuygjQCXb6eBwSEMbZPpTFBJ2KsA1Y31QIi9teplHlQLVZJEswND3g9fH+ErlU
 gDY2sZ//JFJ2Vko9Ty10wN0lPQvmLSNkf4PR4Lfe0JlQauVxVuCfR93FERNV+W76
 Zyz16iRuuFQI2VWq01ptQ==
X-Virus-Scanned: Debian amavis at 
Received: from mail.thinkmo.de ([127.0.0.1])
 by localhost (mail.thinkmo.de [127.0.0.1]) (amavis, port 10024) with ESMTP
 id L-ZcEO6wbbKb; Sat, 27 Jun 2026 08:06:43 +0000 (UTC)
Received: from shell.thinkmo.de (shell.thinkmo.de
 [IPv6:2a01:4f8:271:3f5c:0:22:0:1])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange ECDHE (prime256v1) server-signature ECDSA (secp384r1)
 server-digest SHA384) (No client certificate requested)
 by mail.thinkmo.de (Postfix) with ESMTPS id 4gnQ9b0qFCzyRF;
 Sat, 27 Jun 2026 08:06:43 +0000 (UTC)
Date: Sat, 27 Jun 2026 10:06:41 +0200
From: Bastian Blank <waldi@debian.org>
To: 1132846-done@bugs.debian.org
Cc: Paul Gevers <elbrus@debian.org>, 
 Nicola Chiapolini <nicola.chiapolini@physik.uzh.ch>,
 Vincent Lefevre <vincent@vinc17.net>
Subject: Re: Bug#1132846: gimp - Insecurely creates /tmp/gimp/3.2
Message-ID: <amsi6gbckmu63vneb3ume2ydhup5mbtoo6pq2fd7lbxrlgefd7@zs6ivc7oso7y>
Mail-Followup-To: Bastian Blank <waldi@debian.org>, 
 1132846-done@bugs.debian.org, Paul Gevers <elbrus@debian.org>, 
 Nicola Chiapolini <nicola.chiapolini@physik.uzh.ch>,
 Vincent Lefevre <vincent@vinc17.net>
References: <b28d865d-7c70-437a-a922-30bb9b50be23@physik.uzh.ch>
 <b28d865d-7c70-437a-a922-30bb9b50be23@physik.uzh.ch>
 <aaaea820-3d61-4c6e-b777-17d648ab90cb@debian.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <aaaea820-3d61-4c6e-b777-17d648ab90cb@debian.org>

Version: 3.2.4-1

On Sat, Jun 27, 2026 at 08:53:21AM +0200, Paul Gevers wrote:
> That's my observation as well, so lets document that the version in unstable
> is fixed. (I'm not closing the bug just yet, to allow for further
> inspection/tracking).

This was fixed with:

| commit a85e5286fd2064bfd684e85f3536626bcc2973cb
| Author: Jehan <jehan@girinstud.io>
| Date:   Mon Apr 6 16:09:09 2026 +0200
| 
|     Issue #14681: Permission denied opening image - /tmp/gimp/3.0/ cannot be shared.
|     
|     Let's create the folder returned by gimp_temp_directory() ourselves, the
|     first time this function is called, using a randomized name. This will
|     ensure that we won't conflict with another user running GIMP on the same
|     machine if using the base /tmp/ (which is usually the case on Linux).
|     
|     Furthermore, since we create the temp folder at this level, we will also
|     delete it when quitting (but only if it's empty, as it should). Also I
|     use a single-level folder above the generic temporary directory, this
|     way, it's easier to track and we don't have to delete 2 levels of
|     directories anymore.
|     
|     When the environment variable GIMP3_TEMPDIR is set though, we do not
|     create the folder, nor do we try and delete it.

Bastian

-- 
Youth doesn't excuse everything.
		-- Dr. Janice Lester (in Kirk's body), "Turnabout Intruder",
		   stardate 5928.5.]