{"id":"CLSA-2026-1788774195","summary":"gimp: Fix of 7 CVEs","details":"- CVE-2026-18301: validate the PSD channel data allocation with a checked\n  multiplication and fail cleanly instead of overflowing the raw_data buffer\n- CVE-2026-18302: pass the correct row stride to convert_int2uint() when\n  loading separate-plane TIFFs so the conversion cannot write past the end of\n  the heap-allocated row buffer\n- CVE-2026-18303: reject indexed TIFFs whose bit depth implies a color map\n  larger than 256 entries instead of overrunning the 768-byte stack cmap\n- CVE-2026-18304: compute the TIFF upscale tile area as gsize and use a\n  checked allocation so an integer overflow cannot undersize bw_buffer\n- CVE-2026-18305: use checked multiplications for the TIFF RGBA image\n  allocation instead of an overflowing width times height product\n- CVE-2026-18306: reject SGI files whose bits-per-pixel is outside the\n  supported range of 1 to 2 and cast the SGI row pointer arithmetic to gsize\n  so an integer overflow cannot lead to an out-of-bounds write\n- CVE-2026-18307: derive the TIFF bytes-per-pixel consistency check from the\n  source babl format so a samples-per-pixel below the photometric setting\n  cannot undercount the buffer size, and size the contiguous tile buffer with\n  checked multiplications instead of trusting TIFFTileSize()","modified":"2026-10-26T09:30:45.962557418Z","published":"2026-09-07T09:43:31Z","upstream":["CVE-2026-18301","CVE-2026-18302","CVE-2026-18303","CVE-2026-18304","CVE-2026-18305","CVE-2026-18306","CVE-2026-18307"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1788774195.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18301"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18302"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18303"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18304"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18305"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18306"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18307"}],"affected":[{"package":{"name":"gimp","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/gimp?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788774195.json"}},{"package":{"name":"gimp-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/gimp-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788774195.json"}},{"package":{"name":"gimp-devel-tools","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/gimp-devel-tools?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788774195.json"}},{"package":{"name":"gimp-libs","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/gimp-libs?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.99.8-4.el9.2.tuxcare.els19"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1788774195.json"}}],"schema_version":"1.9.0"}