Skip to content
OpenAdvisories
High ELSA-2026-17533 4 CVEs

Important: gimp:2.8 security update (Oracle Linux 8)

Published May 15, 2026 · Updated May 15, 2026

Summary

gimp
[2:2.8.22-26.6]
- fix CVE-2026-4150
- fix CVE-2026-4153
- fix CVE-2026-4154
- fix CVE-2026-4887

[2:2.8.22-26.5]
- fix CVE-2026-0797
- fix CVE-2026-2044
- fix CVE-2026-2045
- fix CVE-2026-2048

[2:2.8.22-26.4]
- fix CVE-2025-14422

[2:2.8.22-26.3]
- fix CVE-2025-10920
- fix CVE-2025-10921
- fix CVE-2025-10922
- fix CVE-2025-10923
- fix CVE-2025-10924
- fix CVE-2025-10925
- fix CVE-2025-10934

[2:2.8.22-26.2]
- fix CVE-2025-5473 (RHEL-95696)

[2:2.8.22-26.1]
- fix CVE-2025-48797 (RHEL-93503)
- fix CVE-2025-48798 (RHEL-93506)

[2:2.28.22-26]
- bump spec

[2:2.8.22-25]
- fix CVE-2023-44442
- fix CVE-2023-44444
- disable gimp-2.8.22-python-path.patch required for flatpak
- partially cherry-pick from upstream commit 2987f012 to fix fclose leak
Resolves: RHEL-17048 RHEL-17060

[2:2.8.22-24]
- fallback to RPM gegl

[2:2.8.22-23]
- enforce gegl04

pygobject2
[2.28.7-5]
- bump spec to fix NVR

[2.28.7-4]
- update python macro to python2

[2.28.7-3]
- Add MIT license

[2.28.7-2.1]
- Fix python shebangs (#1580854)

[2.28.7-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.28.7-1]
- Update to 2.28.7

[2.28.6-19]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[2.28.6-18]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.28.6-17]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.28.6-16]
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages

pygtk2
[2.24.0-25]
- Fix shebang mangling for _prefix=app (#1907579)
- disable numpy for flatpak (#1907579)

[2.24.0-24]
- remove libglade dependency and sub-package (#1622134)

[2.24.0-23.1]
- fix python2 regex in sed command

[2.24.0-23]
- resotre doc sub package

[2.24.0-22]
- fix python2 macros

[2.24.0-21.1]
- Fix python shebangs (#1580855)

[2.24.0-21]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.24.0-20]
- Try again to fix shebangs

[2.24.0-19]
- Fix shebangs

[2.24.0-18]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

python2-pycairo
[1.16.3-7]
- bump spec for NVR fix

[1.16.3-6]
- Rename pycairo to python2-pycairo (RCM-39388)

[1.16.3-5]
- Add python3 packages (RCM-39388)
- remove python3-test due its missing in build root

[1.16.3-4]
- Setup python2 stream branch for python2 binding of cairo library

[1.16.3-3]
- Remove the python2 subpackages
https://bugzilla.redhat.com/show_bug.cgi?id=1590820

[1.16.3-2]
- Allow Python 2 for build
See: https://hurl.corp.redhat.com/rhel8-py2

- Skip tests on Python 2 (python2-pytest is being removed)

[1.16.3-1]
- Update to 1.16.3

[1.16.1-1]
- Update to 1.16.1

[1.16.0-1]
- Update to 1.16.0

[1.15.6-1]
- Update to 1.15.6

Fixed packages 14

ReleasePackageFixed in
Oracle Linux · 8 gimp 2:2.8.22-26.module+el8.10.0+90890+b83bdeeb.6
Oracle Linux · 8 gimp-devel 2:2.8.22-26.module+el8.10.0+90890+b83bdeeb.6
Oracle Linux · 8 gimp-devel-tools 2:2.8.22-26.module+el8.10.0+90890+b83bdeeb.6
Oracle Linux · 8 gimp-libs 2:2.8.22-26.module+el8.10.0+90890+b83bdeeb.6
Oracle Linux · 8 pygobject2 0:2.28.7-5.module+el8.10.0+90497+ae78887f
Oracle Linux · 8 pygobject2-codegen 0:2.28.7-5.module+el8.10.0+90497+ae78887f
Oracle Linux · 8 pygobject2-devel 0:2.28.7-5.module+el8.10.0+90497+ae78887f
Oracle Linux · 8 pygobject2-doc 0:2.28.7-5.module+el8.10.0+90497+ae78887f
Oracle Linux · 8 pygtk2 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5
Oracle Linux · 8 pygtk2-codegen 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5
Oracle Linux · 8 pygtk2-devel 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5
Oracle Linux · 8 pygtk2-doc 0:2.24.0-25.module+el8.9.0+90151+46a7e4b5
Oracle Linux · 8 python2-cairo 0:1.16.3-7.module+el8.10.0+90497+ae78887f
Oracle Linux · 8 python2-cairo-devel 0:1.16.3-7.module+el8.10.0+90497+ae78887f

Vulnerabilities 4

  • High 7.8

    GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

    GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target m…

  • High 7.8

    GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that th…

  • High 7.8

    GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

    GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target m…

  • Medium 6.1

    Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

    A flaw was found in GIMP. This issue is a heap buffer over-read in GIMP PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image. Successful exploitation could lead to out-of-b…