gimp-2.10.38-4.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14534-1 Final 1 1 2024-11-30T00:00:00Z current 2024-11-30T00:00:00Z 2024-11-30T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z gimp-2.10.38-4.1 on GA media These are all security issues fixed in the gimp-2.10.38-4.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14534 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7UFJHBPLWAYPCEKYTYRWURM3JQUU2ZPU/ E-Mail link for openSUSE-SU-2024:14534-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-32990/ SUSE CVE CVE-2022-32990 page https://www.suse.com/security/cve/CVE-2023-44443/ SUSE CVE CVE-2023-44443 page openSUSE Tumbleweed gimp-2.10.38-4.1 gimp-devel-2.10.38-4.1 gimp-lang-2.10.38-4.1 gimp-plugin-aa-2.10.38-4.1 gimp-plugins-python-2.10.38-4.1 libgimp-2_0-0-2.10.38-4.1 libgimpui-2_0-0-2.10.38-4.1 gimp-2.10.38-4.1 as a component of openSUSE Tumbleweed gimp-devel-2.10.38-4.1 as a component of openSUSE Tumbleweed gimp-lang-2.10.38-4.1 as a component of openSUSE Tumbleweed gimp-plugin-aa-2.10.38-4.1 as a component of openSUSE Tumbleweed gimp-plugins-python-2.10.38-4.1 as a component of openSUSE Tumbleweed libgimp-2_0-0-2.10.38-4.1 as a component of openSUSE Tumbleweed libgimpui-2_0-0-2.10.38-4.1 as a component of openSUSE Tumbleweed An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via a crafted XCF file, causing a Denial of Service (DoS). CVE-2022-32990 openSUSE Tumbleweed:gimp-2.10.38-4.1 openSUSE Tumbleweed:gimp-devel-2.10.38-4.1 openSUSE Tumbleweed:gimp-lang-2.10.38-4.1 openSUSE Tumbleweed:gimp-plugin-aa-2.10.38-4.1 openSUSE Tumbleweed:gimp-plugins-python-2.10.38-4.1 openSUSE Tumbleweed:libgimp-2_0-0-2.10.38-4.1 openSUSE Tumbleweed:libgimpui-2_0-0-2.10.38-4.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7UFJHBPLWAYPCEKYTYRWURM3JQUU2ZPU/ https://www.suse.com/security/cve/CVE-2022-32990.html CVE-2022-32990 https://bugzilla.suse.com/1201192 SUSE Bug 1201192 GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PSP files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-22096. CVE-2023-44443 openSUSE Tumbleweed:gimp-2.10.38-4.1 openSUSE Tumbleweed:gimp-devel-2.10.38-4.1 openSUSE Tumbleweed:gimp-lang-2.10.38-4.1 openSUSE Tumbleweed:gimp-plugin-aa-2.10.38-4.1 openSUSE Tumbleweed:gimp-plugins-python-2.10.38-4.1 openSUSE Tumbleweed:libgimp-2_0-0-2.10.38-4.1 openSUSE Tumbleweed:libgimpui-2_0-0-2.10.38-4.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7UFJHBPLWAYPCEKYTYRWURM3JQUU2ZPU/ https://www.suse.com/security/cve/CVE-2023-44443.html CVE-2023-44443 https://bugzilla.suse.com/1217162 SUSE Bug 1217162