SUSE-SU-2026:4409-1: important: Security update for gimp
SLE-SECURITY-UPDATES
null at suse.de
Thu Oct 1 12:31:02 UTC 2026
# Security update for gimp
Announcement ID: SUSE-SU-2026:4409-1
Release Date: 2026-10-01T07:07:36Z
Rating: important
References:
* bsc#1276230
* bsc#1276231
* bsc#1276232
* bsc#1276233
* bsc#1276234
* bsc#1276235
* bsc#1276236
* bsc#1280511
* bsc#1280512
* bsc#1280739
Cross-References:
* CVE-2026-18301
* CVE-2026-18302
* CVE-2026-18303
* CVE-2026-18304
* CVE-2026-18305
* CVE-2026-18306
* CVE-2026-18307
* CVE-2026-90947
* CVE-2026-90948
* CVE-2026-92248
CVSS scores:
* CVE-2026-18301 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18301 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18302 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18302 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18303 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18303 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18304 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18304 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18305 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18305 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18306 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18306 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18307 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-18307 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-90947 ( SUSE ): 8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-90947 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-90947 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-90948 ( SUSE ): 8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-90948 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-90948 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92248 ( SUSE ): 8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-92248 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-92248 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
* openSUSE Leap 15.4
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Linux Enterprise Workstation Extension 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves 10 vulnerabilities can now be installed.
## Description:
This update for gimp fixes the following issues:
* CVE-2026-18301: Vulnerability Report at read_channel_data (bsc#1276230).
* CVE-2026-18302: TIF File Parsing Heap-based Buffer Overflow (bsc#1276231).
* CVE-2026-18303: TIF File Parsing Stack-based Buffer Overflow (bsc#1276232).
* CVE-2026-18304: TIF File Parsing Integer Overflow Remote Code Execution
Vulnerability (bsc#1276233).
* CVE-2026-18305: TIF File Parsing Integer Overflow Remote Code Execution
Vulnerability (bsc#1276234).
* CVE-2026-18306: SGI File Parsing Integer Overflow Remote Code Execution
Vulnerability (bsc#1276235).
* CVE-2026-18307: File Parsing Heap-based Buffer Overflow Remote Code
Execution Vulnerability (bsc#1276236).
* CVE-2026-90947: out-of-bounds write in the lighting effects plugin when
processing a crafted preset file due to improper validation of the number of
light sources (bsc#1280511).
* CVE-2026-90948: heap buffer overflow in the ICO loader when processing ICO
files with embedded PNG images due to an integer overflow during calculation
of buffer sizes (bsc#1280512).
* CVE-2026-92248: integer overflow when generating a thumbnail preview for a
PSD file can lead to a heap buffer overflow (bsc#1280739).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* openSUSE Leap 15.4
zypper in -t patch SUSE-2026-4409
* SUSE Linux Enterprise Workstation Extension 15 SP7
zypper in -t patch SUSE-SLE-Product-WE-15-SP7-2026-4409
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4409
## Package List:
* openSUSE Leap 15.4 (aarch64 i586 ppc64le s390x x86_64)
* gimp-devel-2.10.30-150400.3.79.1
* gimp-plugin-aa-2.10.30-150400.3.79.1
* libgimp-2_0-0-debuginfo-2.10.30-150400.3.79.1
* gimp-2.10.30-150400.3.79.1
* gimp-debuginfo-2.10.30-150400.3.79.1
* gimp-debugsource-2.10.30-150400.3.79.1
* gimp-devel-debuginfo-2.10.30-150400.3.79.1
* gimp-plugin-aa-debuginfo-2.10.30-150400.3.79.1
* libgimpui-2_0-0-2.10.30-150400.3.79.1
* libgimp-2_0-0-2.10.30-150400.3.79.1
* libgimpui-2_0-0-debuginfo-2.10.30-150400.3.79.1
* openSUSE Leap 15.4 (noarch)
* gimp-lang-2.10.30-150400.3.79.1
* openSUSE Leap 15.4 (x86_64)
* libgimpui-2_0-0-32bit-debuginfo-2.10.30-150400.3.79.1
* libgimp-2_0-0-32bit-2.10.30-150400.3.79.1
* libgimp-2_0-0-32bit-debuginfo-2.10.30-150400.3.79.1
* libgimpui-2_0-0-32bit-2.10.30-150400.3.79.1
* openSUSE Leap 15.4 (aarch64_ilp32)
* libgimp-2_0-0-64bit-debuginfo-2.10.30-150400.3.79.1
* libgimpui-2_0-0-64bit-debuginfo-2.10.30-150400.3.79.1
* libgimpui-2_0-0-64bit-2.10.30-150400.3.79.1
* libgimp-2_0-0-64bit-2.10.30-150400.3.79.1
* SUSE Linux Enterprise Workstation Extension 15 SP7 (x86_64)
* gimp-devel-2.10.30-150400.3.79.1
* libgimp-2_0-0-debuginfo-2.10.30-150400.3.79.1
* gimp-2.10.30-150400.3.79.1
* gimp-debuginfo-2.10.30-150400.3.79.1
* gimp-debugsource-2.10.30-150400.3.79.1
* gimp-devel-debuginfo-2.10.30-150400.3.79.1
* libgimpui-2_0-0-2.10.30-150400.3.79.1
* libgimp-2_0-0-2.10.30-150400.3.79.1
* libgimpui-2_0-0-debuginfo-2.10.30-150400.3.79.1
* SUSE Linux Enterprise Workstation Extension 15 SP7 (noarch)
* gimp-lang-2.10.30-150400.3.79.1
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x)
* libgimp-2_0-0-debuginfo-2.10.30-150400.3.79.1
* gimp-debuginfo-2.10.30-150400.3.79.1
* gimp-debugsource-2.10.30-150400.3.79.1
* libgimpui-2_0-0-2.10.30-150400.3.79.1
* libgimp-2_0-0-2.10.30-150400.3.79.1
* libgimpui-2_0-0-debuginfo-2.10.30-150400.3.79.1
* SUSE Package Hub 15 15-SP7 (aarch64)
* gimp-devel-2.10.30-150400.3.79.1
* gimp-plugin-aa-2.10.30-150400.3.79.1
* gimp-2.10.30-150400.3.79.1
* gimp-devel-debuginfo-2.10.30-150400.3.79.1
* gimp-plugin-aa-debuginfo-2.10.30-150400.3.79.1
* SUSE Package Hub 15 15-SP7 (noarch)
* gimp-lang-2.10.30-150400.3.79.1
## References:
* https://www.suse.com/security/cve/CVE-2026-18301.html
* https://www.suse.com/security/cve/CVE-2026-18302.html
* https://www.suse.com/security/cve/CVE-2026-18303.html
* https://www.suse.com/security/cve/CVE-2026-18304.html
* https://www.suse.com/security/cve/CVE-2026-18305.html
* https://www.suse.com/security/cve/CVE-2026-18306.html
* https://www.suse.com/security/cve/CVE-2026-18307.html
* https://www.suse.com/security/cve/CVE-2026-90947.html
* https://www.suse.com/security/cve/CVE-2026-90948.html
* https://www.suse.com/security/cve/CVE-2026-92248.html
* https://bugzilla.suse.com/show_bug.cgi?id=1276230
* https://bugzilla.suse.com/show_bug.cgi?id=1276231
* https://bugzilla.suse.com/show_bug.cgi?id=1276232
* https://bugzilla.suse.com/show_bug.cgi?id=1276233
* https://bugzilla.suse.com/show_bug.cgi?id=1276234
* https://bugzilla.suse.com/show_bug.cgi?id=1276235
* https://bugzilla.suse.com/show_bug.cgi?id=1276236
* https://bugzilla.suse.com/show_bug.cgi?id=1280511
* https://bugzilla.suse.com/show_bug.cgi?id=1280512
* https://bugzilla.suse.com/show_bug.cgi?id=1280739
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261001/e98bf885/attachment.htm>
More information about the sle-security-updates
mailing list