GNU Image Manipulation Program
gimp:gimp from the portA flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction.
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack out-of-bounds access. This issue can result in an application crash…
A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used_clrs (palette count) parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of s…
A flaw was found in the file-pvr plugin in GIMP. When processing a specially crafted PVR image file, the VQ (compressed) decoder does not properly perform memory bounds checking. This missing validation results in a heap out-of-bounds read. This issue can result in an application crash, leading to a denial of service or a limited information disclosure of h…
A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row size and improperly handles cases where the number of color planes (nPlanes) is zero. This causes a row size mismatch that bypasses memory bounds checking, resulting in heap out-of-bounds read…
A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited in…
A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service.
A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit in…
A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calculates the size of the Color Look-Up Table (CLUT) due to an integer overflow. This occurs when multiplying num_colors and num_cluts, both 16-bit unsigned short integers, resulting in a value exceeding the maximum integer limit. An attacker…
MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files…
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated buffer size. This incorrect validation leads to improper bounds checking, causing a heap out-of-boun…
pkg audit reports nothing for this version.graphics/gimp3-app: update to 3.2.6 release (+) Release notes: https://www.gimp.org/news/2026/09/10/gimp-3-2-6-released/42bb80f52b
graphics/gimp3-app: update to 3.2.4 release (+) Release notes: https://www.gimp.org/news/2026/03/28/gimp-3-2-2-released/ \ https://www.gimp.org/news/2026/04/19/gimp-3-2-4-released/81b020b1f0
graphics/libjxl: update to 0.12 Changes: https://github.com/libjxl/libjxl/releases/tag/v0.12.0 Reported by: GitHub (watch releases)fc57321249
graphics/gimp3-app: Clean up USES=python Python 3.10 is the minimal supported Python 3. Approved by: portmgr (blanket) With hat: python9f228a4c42
graphics/gimp3-app: Fix CPE data According to NIST CPE Dictionary gnu:gimp is deprecated in favour of gimp:gimp36cc409c95
*: Bump PORTREVISION on Poppler's consumers7ddc6804bf
graphics/gimp3-app: update to 3.2.0 release (+) Release notes: https://www.gimp.org/news/2026/03/14/gimp-3-2-released/91953f4e94
graphics/lcms2: Bump PORTREVISION of dependent ports for shlib change PR: 292881 Reported by: Petr Lampa <lampa@fit.vutbr.cz>2adc4bef7d
graphics/gimp3-app: update to 3.0.8 release (+) Micro releases like 3.0.8 are focused on fixing bugs and regressions. Release notes: https://www.gimp.org/news/2026/01/24/gimp-3-0-8-released/ Changelog: https://gitlab.gnome.org/GNOME/gimp/-/blob/01df768b6756a04ecfaa410156f23ee95b3085e9/NEWS6d867df253
misc/iso-codes: Fix 4ae07eaae285bbb61cebc9bb287d67f9c3200124 - Fix *_DEPENDS of dependent ports - Bump PORTREVISION for package change Reported by: fluffyad4b417832
graphics/poppler: bump consumers of graphics/poppler PR: 291277 Exp-run by: antoine3076d31cda
graphics/gimp3-app: add devel/apstream to LIB_DEPENDS (+) On some systems with missed devel/appsteam from installed, gimp3 app claims missed library ld-elf.so.1: Shared object "libappstream.so.5" not found, required by "gimp" Declare devel/apsstream not as only build dependency but also add as LIB_DEPENDS PR: 291058b1601c5bba
graphics/gimp3-app: fix build on armv7 No OpenMP on armv7 unfortunately. While we are at it, rework the "no FP exceptions" patch to use the newer <fenv.h> interface, as the old one is not supported everywhere. Approved by: portmgr (build fix blanket) MFH: 2025Q4927fbf0126
graphics/gimp3-app: update to 3.0.6 release (+) Micro releases like 3.0.6 are focused on fixing bugs and regressions. Many of these have already been announced in development 3.1.2 and 3.1.4 news posts. Release notes: https://www.gimp.org/news/2025/10/06/gimp-3-0-6-released/6963028020
graphics/gimp3-app: make javascript plugins optional (+) PR: 2895008619268529
*: Bump PORTREVISION of graphics/openexr users (including those where openexr is only an option)d6519311ed
*: Bump PORTREVISION for math/Imath update566d74ed6b
graphics/gimp3-app: mark LUAJIT option as broken (+) Unfortunately, our luajit cannot utilize devel/lua-lgi module to get full lua scripting support in GIMP3. Moreover, GIMP3 is declared only Lua 5.1 compatibility yet. PR: 288623908e15d5ce
graphics/gimp3-app: fix packaging with CFITSIO=OFF (+) PR: 288181d8ba8e3aca
graphics/gimp3-app: update to 3.0.4 release (+) While here, improve lua51 support Changelog: https://www.gimp.org/news/2025/05/18/gimp-3-0-4-released/5968644072
lang/luajit: update to v2.1 Disconnect lang/luajit-devel from the build, will be removed soon. Bump PORTREVISIONs for the consumers. Discussed with: adamw PR: 2253420af0578acb
graphics/gimp3-app: Fix plist when HEIF option is enabled Error: Orphaned: lib/gimp/%%ABIVER%%/plug-ins/file-heif/file-heif Approved by: blanket (build fix)74859c0e11
graphics/gimp3-app: Add HELP option Documentation is updated to match 3.0-series Approved by: blanket11fe0c0fd6
graphics/poppler: bump dependent ports78c4bd4996
graphics/gimp3-app: add libxslt as direct build dependency PR: 285970ddf194b7e0
graphics/gimp3-app: add GIMP 3 to the ports tree (+) Add GIMP 3.0.2 as separate port until plugins (including GutenPring) will not be ported to new API Ancient MNG support is disabled and marked as BROKEN, our graphics/libmng port is borked by design Release notes: https://www.gimp.org/news/2025/03/16/gimp-3-0-released/ \ https://www.gimp.org/news/2025/03/23/gimp-3-0-2-released/6f0e3bb80b