[From nobody Thu Nov 5 13:27:06 2026 Received: (at submit) by bugs.debian.org; 20 Oct 2026 05:00:50 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-5.7 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,FOURLA,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,FROMDEVELOPER,HEADER_FROM_DIFFERENT_DOMAINS, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 41; hammy, 150; neutral, 24; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--H*M:valinor, 0.000-+--H*M:lorien, 0.000-+--UD:security-tracker.debian.org, 0.000-+--securitytrackerdebianorg Return-path: <salvatore.bonaccorso@gmail.com> Received: from mail-lj1-x22c.google.com ([2a00:1450:4864:20::22c]:46090) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <salvatore.bonaccorso@gmail.com>) id 1xJ1xx-002DnR-1M for submit@bugs.debian.org; Tue, 20 Oct 2026 05:00:50 +0000 Received: by mail-lj1-x22c.google.com with SMTP id 38308e7fff4ca-3a1f628b1d1so23644341fa.0 for <submit@bugs.debian.org>; Mon, 19 Oct 2026 22:00:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792472440; x=1793077240; darn=bugs.debian.org; h=content-disposition:content-type:mime-version:message-id:subject:to :from:date:sender:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UoWCUgJWLGfivMEXIOU4IkM08YpVaqGwHv/JIn/fogk=; b=UrVqea+vhwD89c/mdhN8dvyYMFp81SbR3V3KfDx5KojbxblkFZCtklYD7XQkuxegTj sgOffqDSzijMXbFBCpDj3isRI4IxeatuaWueU0nijr9G0UdWcPijxsnYU4NTFhgkrsTc anGY3EnA8aYWJj2Y56mDYZpOugSliEMYDyjOh0OWDaoQCPnnNsD8NGg/OQlMJLaCl2I4 NPZn1Q7a9LVoRQz/FhcF9S+JjcCM5kPPx3u6lWZVQUUsNOoEnsQRK5ofuHVFG5Sjz2Z2 nhM3pQVYuHLUbSm6Jo2JkvF+OEgp3JvKJ03ua6heqnMMN5IUoJiqOtVqUBxBp4VygQV9 McZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792472440; x=1793077240; h=content-disposition:content-type:mime-version:message-id:subject:to :from:date:sender:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UoWCUgJWLGfivMEXIOU4IkM08YpVaqGwHv/JIn/fogk=; b=BFsZNWBXBMtyc2EOblEbzdZl+9MvWCb96Z5Kpx6+rqzetfIoxNpiqFMRY/8QSCDrPf Nw4Y9rPOm0INQ3gUqogO64m2j9orUxu4htdtpJdR35eClMHixaAgTweMl4Zgyy9SrRWa RjNn4NopePn6FaQksffFMA52GJxLToGpaYnCQoO3UjXQ7nx4W0ISP/lix1eJinyN5M17 T8V5UEjNB84YOfjtVNsQobIGtvnXScPaHb+9NvQpM7hQQrfhiJI3rs+G05mOKDo1CwrS Q4V5Edyp4sailtxbWrRs8xjkYzVwLHpoAcYQuCB4B2ghr6AZ7LiUlivXfahCPqTO6K/y McSQ== X-Gm-Message-State: AFq9FYJExm5U1vsXPKMnTT5HO5cKuRJw5Mu+Bz8O72Ccq1RNl9m0mysA Ob2QIUPoRvRogBdC56lGCJ9Cfu0+U4z9+jyYB7AkMLcFxNfq7XVXhnDaPAYrrsol X-Gm-Gg: AYBFou36HJfa4nY0NHg3SdUUxT/sXH1ZwO4+ftMgny5akGLzWRVSSfvPu80iHzSg94d 1zkeCq65LOykNXUhSB/DnhtHQQ8wCFPFYkJFm+RPSucOb4a9enGIYGFJzqMXMDsWzQC+04qvf1w 2PkI1fAvyKLP+CCgxMp8jrujQtX5jd5qKgjaJzywHamb4dEOAjNHPk4IeQzkbfk+Gn1o/nj7ev3 oYxdUCsQMLrl98kvPAIud+MdcImXAstV3MnMxiYM0MqxSL+J5RyzfuT9D5nIr5V0VQv+1hUC8Rb ufCCZEM2NAYH2ZAVZgsCuc8crv1pCwSGh+372a2/8wUy9NskI1MTNRQK+CWFGknvs7uCUQyFWLc Rvl4MQ2d+3euHQxj5SdhGzonjQDv3QeX58jOMGAXEjfcnCgSmK+euTKJdGVA+YsECaPyMTrJyCr GOYcRPaMeItDH+XBRqYTTpVpmeqCC6+w4V5k/62qyJcYLJuqnQ9PE5iO4= X-Received: by 2002:a05:651c:41d7:b0:3a9:811d:3a58 with SMTP id 38308e7fff4ca-3ab292b66efmr20315921fa.14.1792472440269; Mon, 19 Oct 2026 22:00:40 -0700 (PDT) Received: from elende (elende.valinor.li. [2a01:4f9:6a:1c47::2]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-3ab401492b4sm12731741fa.39.2026.10.19.22.00.38 for <submit@bugs.debian.org> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Oct 2026 22:00:38 -0700 (PDT) Sender: Salvatore Bonaccorso <salvatore.bonaccorso@gmail.com> Date: Tue, 20 Oct 2026 07:00:37 +0200 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: gimp: CVE-2026-112259 Message-ID: <atb1dft77qfdSOmz@lorien.valinor.li> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Delivered-To: submit@bugs.debian.org Source: gimp Version: 3.2.6-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Forwarded: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16835 Hi, The following vulnerability was published for gimp. CVE-2026-112259[0]: | A flaw was found in GIMP. Importing a crafted SBZ palette without a | color-model attribute can cause a NULL pointer dereference during | string comparison, resulting in denial of service of the GIMP | application. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-112259 https://www.cve.org/CVERecord?id=CVE-2026-112259 [1] https://gitlab.gnome.org/GNOME/gimp/-/work_items/16835 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]