[From nobody Sat Jun 27 09:09:07 2026 Received: (at submit) by bugs.debian.org; 6 Apr 2026 09:52:00 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-20.9 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,FOURLA,FROMDEVELOPER,FVGT_m_MULTI_ODD, HAS_PACKAGE,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 19; hammy, 150; neutral, 287; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--python3, 0.000-+--forky, 0.000-+--HTo:N*Debian Return-path: <waldi@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <waldi@debian.org>) id 1w9gch-0007qu-2Y for submit@bugs.debian.org; Mon, 06 Apr 2026 09:51:59 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Bastian Blank <waldi@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: gimp - Insecurely creates /tmp/gimp/3.2 Message-ID: <177546911368.937603.1196119365055976175.reportbug@steamhammer.waldi.eu.org> X-Mailer: reportbug 13.2.0 Date: Mon, 06 Apr 2026 11:51:53 +0200 Delivered-To: submit@bugs.debian.org X-CrossAssassin-Score: 2 UGFja2FnZTogZ2ltcApWZXJzaW9uOiAzLjIuMi0xClNldmVyaXR5OiBzZXJpb3VzClRhZ3M6IHNl Y3VyaXR5ClgtRGViYnVncy1DYzogd2FsZGlAZGViaWFuLm9yZywgRGViaWFuIFNlY3VyaXR5IFRl YW0gPHRlYW1Ac2VjdXJpdHkuZGViaWFuLm9yZz4KClN0YXJ0aW5nIGdpbXAgY3JlYXRlcyAvdG1w L2dpbXAvMy4yIGluIGFuIGluc2VjdXJlIHdheS4gIE5laXRoZXIgaXMgdGhlCm5hbWUgcmFuZG9t aXplZCwgbm9yIGlzIHRoZXJlIG11Y2ggY2FyZSB0YWtlbiB3aXRoIGNyZWF0aW5nIHRoZQpkaXJl Y3RvcnkgaW4gYSBzZWN1cmUgd2F5IGluIGEgd29ybGQgd3JpdGFibGUgZGlyZWN0b3J5LiAgVGhp cyBzaG91bGQgYmUKQ1dFLTM3OC4KCnN0cmFjZSBzaG93czoKCnwgZXhlY3ZlKCIvdXNyL2Jpbi9n aW1wIiwgWyJnaW1wIl0sIDB4N2ZmZDQ4YTJlNWEwIC8qIDU3IHZhcnMgKi8pID0gMAp8IFvigKZd CnwgbmV3ZnN0YXRhdChBVF9GRENXRCwgIi91c3IvYmluL2NvbnZlcnQiLCB7c3RfbW9kZT1TX0lG UkVHfDA3NTUsIHN0X3NpemU9MTUwMTYsIC4uLn0sIDApID0gMAp8IGZhY2Nlc3NhdDIoQVRfRkRD V0QsICIvdG1wL2dpbXAvMy4yIiwgRl9PSywgQVRfU1lNTElOS19OT0ZPTExPV3xBVF9FQUNDRVNT KSA9IC0xIEVOT0VOVCAoTm8gc3VjaCBmaWxlIG9yIGRpcmVjdG9yeSkKfCBta2RpcigiL3RtcC9n aW1wLzMuMiIsIDA3NzcpICAgICAgICAgICAgPSAtMSBFTk9FTlQgKE5vIHN1Y2ggZmlsZSBvciBk aXJlY3RvcnkpCnwgbWtkaXIoIi90bXAvZ2ltcCIsIDA3NzcpICAgICAgICAgICAgICAgID0gMAp8 IG1rZGlyKCIvdG1wL2dpbXAvMy4yIiwgMDc3NykgICAgICAgICAgICA9IDAKfCBmYWNjZXNzYXQy KEFUX0ZEQ1dELCAiL2hvbWUvd2FsZGkvLmNhY2hlL2dpbXAvMy4yIiwgRl9PSywgQVRfU1lNTElO S19OT0ZPTExPV3xBVF9FQUNDRVNTKSA9IDAKfCBuZXdmc3RhdGF0KEFUX0ZEQ1dELCAiL2hvbWUv d2FsZGkvLmNhY2hlL2dpbXAvMy4yIiwge3N0X21vZGU9U19JRkRJUnwwNzU1LCBzdF9zaXplPTAs IC4uLn0sIDApID0gMAp8IG9wZW5hdChBVF9GRENXRCwgIi9ob21lL3dhbGRpLy5jYWNoZS9naW1w LzMuMiIsIE9fUkRPTkxZfE9fTk9OQkxPQ0t8T19DTE9FWEVDfE9fRElSRUNUT1JZKSA9IDEzCgot LSBTeXN0ZW0gSW5mb3JtYXRpb246CkRlYmlhbiBSZWxlYXNlOiBmb3JreS9zaWQKICBBUFQgcHJl ZmVycyB0ZXN0aW5nCiAgQVBUIHBvbGljeTogKDcwMCwgJ3Rlc3RpbmcnKSwgKDUwMCwgJ3Vuc3Rh YmxlLWRlYnVnJyksICg1MDAsICdzdGFibGUtdXBkYXRlcycpLCAoNTAwLCAnb2xkc3RhYmxlLXVw ZGF0ZXMnKSwgKDUwMCwgJ3Vuc3RhYmxlJyksICg1MDAsICdzdGFibGUnKSwgKDUwMCwgJ29sZHN0 YWJsZScpLCAoMSwgJ2V4cGVyaW1lbnRhbCcpCkFyY2hpdGVjdHVyZTogYW1kNjQgKHg4Nl82NCkK Cktlcm5lbDogTGludXggNi4xOS44K2RlYjE0LWFtZDY0IChTTVAgdy8xNiBDUFUgdGhyZWFkczsg UFJFRU1QVCkKTG9jYWxlOiBMQU5HPWRlX0RFLlVURi04LCBMQ19DVFlQRT1kZV9ERS5VVEYtOCAo Y2hhcm1hcD1VVEYtOCksIExBTkdVQUdFPWVuX1VTOmVuClNoZWxsOiAvYmluL3NoIGxpbmtlZCB0 byAvdXNyL2Jpbi9kYXNoCkluaXQ6IHN5c3RlbWQgKHZpYSAvcnVuL3N5c3RlbWQvc3lzdGVtKQpM U006IEFwcEFybW9yOiBlbmFibGVkCgpWZXJzaW9ucyBvZiBwYWNrYWdlcyBnaW1wIGRlcGVuZHMg b246CmlpICBnaW1wLWRhdGEgICAgICAgICAgICAzLjIuMi0xCmlpICBnaXIxLjItZ2ltcC0zLjAg ICAgICAzLjIuMi0xCmlpICBncmFwaHZpeiAgICAgICAgICAgICAxNC4xLjItMQppaSAgbGliYWEx ICAgICAgICAgICAgICAgMS40cDUtNTEuMStiMgppaSAgbGliYXBwc3RyZWFtNSAgICAgICAgMS4x LjItMQppaSAgbGliYXJjaGl2ZTEzdDY0ICAgICAgMy44LjUtMQppaSAgbGliYXNvdW5kMnQ2NCAg ICAgICAgMS4yLjE1LjMtMQppaSAgbGliYmFibC0wLjEtMCAgICAgICAgMTowLjEuMTI0LTEKaWkg IGxpYmJ6Mi0xLjAgICAgICAgICAgIDEuMC44LTYrYjEKaWkgIGxpYmM2ICAgICAgICAgICAgICAg IDIuNDItMTQKaWkgIGxpYmNhaXJvMiAgICAgICAgICAgIDEuMTguNC0zCmlpICBsaWJjZml0c2lv MTB0NjQgICAgICA0LjYuMy0xK2IxCmlpICBsaWJmb250Y29uZmlnMSAgICAgICAyLjE3LjEtNQpp aSAgbGliZnJlZXR5cGU2ICAgICAgICAgMi4xNC4yK2Rmc2ctMQppaSAgbGliZ2NjLXMxICAgICAg ICAgICAgMTYtMjAyNjAzMjItMQppaSAgbGliZ2RrLXBpeGJ1Zi0yLjAtMCAgMi40NC41K2Rmc2ct NAppaSAgbGliZ2VnbC0wLjQtMHQ2NCAgICAgMTowLjQuNzAtMQppaSAgbGliZ2V4aXYyLTIgICAg ICAgICAgMC4xNC42LTIKaWkgIGxpYmdpbXAtMy4wLTAgICAgICAgIDMuMi4yLTEKaWkgIGxpYmds aWIyLjAtMHQ2NCAgICAgIDIuODguMC0xCmlpICBsaWJnb21wMSAgICAgICAgICAgICAxNi0yMDI2 MDMyMi0xCmlpICBsaWJnczEwICAgICAgICAgICAgICAxMC4wNy4wfmRmc2ctMgppaSAgbGliZ3Rr LTMtMHQ2NCAgICAgICAgMy4yNC41Mi0xCmlpICBsaWJndWRldi0xLjAtMCAgICAgICAyMzgtNyti MQppaSAgbGliaGFyZmJ1enowYiAgICAgICAgMTIuMy4yLTIrYjIKaWkgIGxpYmhlaWYxICAgICAg ICAgICAgIDEuMjEuMi00CmlpICBsaWJqcGVnNjItdHVyYm8gICAgICAxOjIuMS41LTQKaWkgIGxp Ympzb24tZ2xpYi0xLjAtMCAgIDEuMTAuOCtkcy0yCmlpICBsaWJqeGwwLjExICAgICAgICAgICAw LjExLjItMC4xCmlpICBsaWJsY21zMi0yICAgICAgICAgICAyLjE3LTEKaWkgIGxpYmx6bWE1ICAg ICAgICAgICAgIDUuOC4yLTIKaWkgIGxpYm1uZzIgICAgICAgICAgICAgIDIuMC4zK2Rmc2ctNQpp aSAgbGlibXlwYWludC0xLjUtMSAgICAgMS42LjAtNCtiMQppaSAgbGlib3BlbmV4ci0zLTQtMzMg ICAgMy40LjYrZHMtNAppaSAgbGlib3BlbmpwMi03ICAgICAgICAgMi41LjQtMQppaSAgbGlicGFu Z28tMS4wLTAgICAgICAgMS41Ny4xLTEKaWkgIGxpYnBhbmdvY2Fpcm8tMS4wLTAgIDEuNTcuMS0x CmlpICBsaWJwYW5nb2Z0Mi0xLjAtMCAgICAxLjU3LjEtMQppaSAgbGlicG5nMTYtMTZ0NjQgICAg ICAgMS42LjU2LTEKaWkgIGxpYnBvcHBsZXItZ2xpYjh0NjQgIDI1LjAzLjAtMTEuMStiMQppaSAg bGlicnN2ZzItMiAgICAgICAgICAgMi42MS4zK2Rmc2ctMytiMQppaSAgbGlicnN2ZzItY29tbW9u ICAgICAgMi42MS4zK2Rmc2ctMytiMQppaSAgbGlic3RkYysrNiAgICAgICAgICAgMTYtMjAyNjAz MjItMQppaSAgbGlidGlmZjYgICAgICAgICAgICAgNC43LjEtMQppaSAgbGlid2VicDcgICAgICAg ICAgICAgMS41LjAtMC4xK2IxCmlpICBsaWJ3ZWJwZGVtdXgyICAgICAgICAxLjUuMC0wLjErYjEK aWkgIGxpYndlYnBtdXgzICAgICAgICAgIDEuNS4wLTAuMStiMQppaSAgbGlid21mLTAuMi03ICAg ICAgICAgMC4yLjE0LTEKaWkgIGxpYndtZmxpdGUtMC4yLTcgICAgIDAuMi4xNC0xCmlpICBsaWJ4 MTEtNiAgICAgICAgICAgICAyOjEuOC4xMy0xCmlpICBsaWJ4Y3Vyc29yMSAgICAgICAgICAxOjEu Mi4zLTErYjEKaWkgIGxpYnhleHQ2ICAgICAgICAgICAgIDI6MS4zLjQtMStiNAppaSAgbGlieGZp eGVzMyAgICAgICAgICAgMTo2LjAuMC0yK2I1CmlpICBsaWJ4bXU2ICAgICAgICAgICAgICAyOjEu MS4zLTQKaWkgIGxpYnhwbTQgICAgICAgICAgICAgIDE6My41LjE3LTErYjQKaWkgIHB5dGhvbjMt Z2kgICAgICAgICAgIDMuNTYuMS0yCmlpICBweXRob24zLWdpLWNhaXJvICAgICAzLjU2LjEtMgpp aSAgeGRnLXV0aWxzICAgICAgICAgICAgMS4yLjEtMgppaSAgemxpYjFnICAgICAgICAgICAgICAg MToxLjMuZGZzZytyZWFsbHkxLjMuMS0zCgpWZXJzaW9ucyBvZiBwYWNrYWdlcyBnaW1wIHJlY29t bWVuZHM6CmlpICBnaG9zdHNjcmlwdCAgMTAuMDcuMH5kZnNnLTIKClZlcnNpb25zIG9mIHBhY2th Z2VzIGdpbXAgc3VnZ2VzdHM6CnBuICBnaW1wLWRhdGEtZXh0cmFzICAgICAgICAgIDxub25lPgpw biAgZ2ltcC1oZWxwLWVuIHwgZ2ltcC1oZWxwICA8bm9uZT4KaWkgIGd2ZnMtYmFja2VuZHMgICAg ICAgICAgICAgMS42MC4wLTEKaWkgIHB5dGhvbjMgICAgICAgICAgICAgICAgICAgMy4xMy45LTMK Ci0tIG5vIGRlYmNvbmYgaW5mb3JtYXRpb24K ]