[Git][security-tracker-team/security-tracker][master] Update status for some gimp issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Nov 4 14:53:45 GMT 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7e836b27 by Salvatore Bonaccorso at 2026-11-04T15:53:10+01:00
Update status for some gimp issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4258,7 +4258,7 @@ CVE-2026-119545 (Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 thro
CVE-2026-119542 (A flaw was found in the Ickle query parser in Infinispan. A query cont ...)
NOT-FOR-US: Infinispan
CVE-2026-119528 (A flaw was found in GIMP. The PSD plug-in\u2019s image resource header ...)
- - gimp <unfixed> (bug #1152636)
+ - gimp 3.2.8-1 (bug #1152636)
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16799
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3031
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/14b2365ecae041e8b50c4a08f9282edb65149439
@@ -22554,24 +22554,24 @@ CVE-2026-112299 (A vulnerability was determined in smrealms smr up to f40380c017
CVE-2026-112297 (A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. Th ...)
NOT-FOR-US: ptbsare anx-calibre-manager
CVE-2026-112261 (A flaw was found in GIMP. Opening a crafted XCF that selects a path an ...)
- - gimp <unfixed>
+ - gimp 3.2.8-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2555748
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16866
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/9ab2b89cbb4c62e72ce50e6430451cad11f15950 (gimp-3-2 branch)
TODO: check, double if isolated correct commit, relation to CVE-2026-112258
CVE-2026-112260 (A flaw was found in GIMP. Opening a crafted XCF with a malformed text- ...)
- - gimp <unfixed>
+ - gimp 3.2.8-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2555730
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16865
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/4b54ae3548f91fd3e4bb5710f2b8b8e311a9d955 (gimp-3-2 branch)
CVE-2026-112258 (A flaw was found in GIMP. The XCF loader can leave a dangling pointer ...)
- - gimp <unfixed>
+ - gimp 3.2.8-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2555588
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16866
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/9ab2b89cbb4c62e72ce50e6430451cad11f15950 (gimp-3-2 branch)
TODO: check, double if isolated correct commit,relation to CVE-2026-112261
CVE-2026-112257 (A flaw was found in GIMP. The PSD thumbnail resource loader performs a ...)
- - gimp <unfixed>
+ - gimp 3.2.8-1
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2555574
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16862
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/b89635399d4b92f0b2872c627ef5966583603537 (gimp-3-2 branch)
@@ -39740,7 +39740,7 @@ CVE-2026-108100 (HortusFox (hortusfox-web) before 6.2 contains an SQL injection
CVE-2026-108096 (Improper authorization in the query resolvers generated by @aws-amplif ...)
NOT-FOR-US: Amazon
CVE-2026-108093 (A flaw was found in GIMP. The XCF loader processes image-simulation-in ...)
- - gimp <unfixed> (bug #1150497)
+ - gimp 3.2.8-1 (bug #1150497)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2548607
TODO: research upstream information, Red Hat bugzilla is not open at 2026-10-09
CVE-2026-108063 (A flaw was found in libhangul. When parsing Hanja dictionary files, th ...)
@@ -42048,19 +42048,19 @@ CVE-2026-106510 (Backstage is an open framework for building developer portals.
CVE-2026-106164 (In Progress\xae Telerik\xae Document Processing SpreadProcessing libra ...)
NOT-FOR-US: Progress Software
CVE-2026-106067 (A heap-based buffer overflow was found in GIMP\u2019s Hot color filter ...)
- - gimp <unfixed> (bug #1150342)
+ - gimp 3.2.8-1 (bug #1150342)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547461
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
CVE-2026-106066 (A heap-based buffer overflow was found in GIMP\u2019s raw data export ...)
- - gimp <unfixed> (bug #1150341)
+ - gimp 3.2.8-1 (bug #1150341)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547459
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
CVE-2026-106065 (A heap-based buffer overflow was found in GIMP\u2019s PCX export plug- ...)
- - gimp <unfixed> (bug #1150340)
+ - gimp 3.2.8-1 (bug #1150340)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547456
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
CVE-2026-106064 (A heap-based buffer overflow was found in GIMP\u2019s GIF export plug- ...)
- - gimp <unfixed> (bug #1150339)
+ - gimp 3.2.8-1 (bug #1150339)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547446
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
CVE-2026-106059 (GitAhead through 2.7.1 on macOS contains a command injection vulnerabi ...)
@@ -42575,21 +42575,21 @@ CVE-2026-106444 (Handlebars provides the power necessary to let users build sema
NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 (v4.7.10)
CVE-2026-106063 (A heap-based buffer overflow was found in GIMP\u2019s DICOM export plu ...)
- - gimp <unfixed> (bug #1150243)
+ - gimp 3.2.8-1 (bug #1150243)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2546668
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3030
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/7e7166e8004bc92ed807c7d845db449ccd4651f0 (gimp-3-2 branch)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/3e79c2aa019702d51f8dd77f7b1a1f0c3c2c98f3 (gimp-3-2 branch)
CVE-2026-106062 (A heap-based buffer overflow was found in GIMP\u2019s DirectDraw Surfa ...)
- - gimp <unfixed> (bug #1150242)
+ - gimp 3.2.8-1 (bug #1150242)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2546654
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3045
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/d528365f7644099d8e07f999660ed0aa71210d85
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/01e6663942adebb347d11ffc7d94ac23da01ff62
CVE-2026-106061 (A flaw was found in GIMP\u2019s X cursor (XMC) thumbnail loader. When ...)
- - gimp <unfixed> (bug #1150241)
+ - gimp 3.2.8-1 (bug #1150241)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2546640
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/f75c99b283b5b0f476289c4ce89f7b7164032736 (gimp-3-2 branch)
@@ -54535,7 +54535,7 @@ CVE-2026-96543
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16326
NOTE: Duplicate of https://gitlab.gnome.org/GNOME/gimp/-/issues/16314
CVE-2026-96544
- - gimp <unfixed> (bug #1149674)
+ - gimp 3.2.8-1 (bug #1149674)
[trixie] - gimp <not-affected> (Vulnerable code not present)
[bookworm] - gimp <not-affected> (Vulnerable code not present)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2539572
@@ -58049,7 +58049,7 @@ CVE-2026-97225 (A flaw has been found in DbGate up to 7.2.5-beta.5. This affects
CVE-2026-97224 (A vulnerability was detected in Excalidraw up to 0.18.1. The impacted ...)
NOT-FOR-US: Excalidraw
CVE-2026-97185 (A flaw was found in GIMP. When processing a specially crafted GIMPress ...)
- - gimp <unfixed> (bug #1148969)
+ - gimp 3.2.8-1 (bug #1148969)
[trixie] - gimp <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16788
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3016
@@ -59835,7 +59835,7 @@ CVE-2026-96546 (A one-byte out-of-bounds heap read flaw was found in GIMP's unco
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/108c72aab28fe069129ad0e545d6b97de5c0ce2f
NOTE: Crash in GUI tool, no security impact
CVE-2026-96545 (An out-of-bounds heap read flaw was found in GIMP's TIM image loader. ...)
- - gimp <unfixed> (bug #1148895)
+ - gimp 3.2.8-1 (bug #1148895)
[trixie] - gimp <not-affected> (Vulnerable code not present)
[bookworm] - gimp <not-affected> (Vulnerable code not present)
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16791
@@ -72982,7 +72982,7 @@ CVE-2026-77860 (In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulner
NOTE: https://nlnetlabs.nl/downloads/unbound/CVE-2026-77860.txt
CVE-2026-92248 (A flaw was found in the file-psd plugin in GIMP. When generating a thu ...)
{DSA-6509-1}
- - gimp <unfixed> (bug #1148477)
+ - gimp 3.2.8-1 (bug #1148477)
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16775
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3009
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/commit/6b1e668699ebebc35152ad6c3db4b445cd78b7df
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e836b27623b50ba7db267e701b9a1549d73d2ba
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e836b27623b50ba7db267e701b9a1549d73d2ba
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/6afbc1ee/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list