🛡️ openSUSE-SU-2026:20055-1 — gimp (CVE-2025-10920 +4 more)
Description
Security update for gimp
This update for gimp fixes the following issues:
Changes in gimp:
Update to 3.0.6:
- Security:
- During development, we received reports from the Zero Day
Initiative of potential security issues with some of our file
import plug-ins. While these issues are very unlikely to
occur with real files, developers like Jacob Boerema and Alx
Sa proactively improved security for those imports.
The resolved reports are:
- ZDI-CAN-27793
- ZDI-CAN-27823
- ZDI-CAN-27836
- ZDI-CAN-27878
- ZDI-CAN-27863
- ZDI-CAN-27684
- Core:
- Many false-positive build warnings have been cleaned out (and
proper issues fixed).
- Various crashes fixed.
- When creating a layer mask from the layer's alpha, but the
layer has no alpha, simply fill the mask with complete
opacity instead of a completely transparent layer.
- Various core infrastructure code reviewed, cleaned up,
refactored and improved, in drawable, layer and filter
handling code, tree view code, and more.
- GIMP_ICONS_LIKE_A_BOSS environment variable is not working
anymore (because "gtk-menu-images" and "gtk-button-images"
have been deprecated in GTK3 and removed in GTK4) and was
therefore removed.
- Lock Content now shows as an undo step.
- Add alpha channel for certain transforms.
- Add alpha channel on filter merge, when necessary.
- Filters can now be applied non-destructively on channels.
- Improved Photoshop brush support.
- After deleting a palette entry, the next entry is
automatically selected. This allows easily deleting several
entries in a row, among other usage.
- Resize image to layers irrespective to selections.
- Improved in-GUI release notes' demo script language:
- We can now set a button value to click it: "toolbox:text,
tool-options:outline=1, tool-options:outline-direction"
- Color selector's module names can be used as identifiers:
"color-editor,color-editor:CMYK=1,color-editor:total-ink-coverage"
- Fixed Alpha to Selection on single layers with no
transparency.
- Various code is slowly ported to newer code, preparing for
GTK4 port (in an unplanned future step):
- Using g_set_str() (optionally redefining it in our core
code to avoid bumping the GLib minimum requirement).
- Start using GListModel in various pieces of code, in
particular getting rid of more and more usage of
GtkTreeView when possible (as it will be deprecated with
GTK4).
- New GimpRow class for all future row widgets.
- Use more of G_DECLARE_DERIVABLE_TYPE and
G_DECLARE_FINAL_TYPE where relevant.
- New GimpContainerListView using a GtkListBox.
- New GimpRowSeparator, GimpRowSettings, GimpRowFilter and
GimpRowDrawableFilter widgets.
- (Experimental) GEX Format was updated.
- Palette import:
- Set alpha value for image palette imports.
- Fix Lab & CMYK ACB palette import.
- Add palette format filters to import dialog, making it more
apparent what palette formats are supported, and giving the
ability to hide irrelevant files.
- Improved filter actions' sensitivity to make sure they are
set insensitive when relevant. In particular filters which
cannot be run non-destructively (e.g. filters with aux
inputs, non-interactive filters and GEGL Graph) must be
insensitive when trying to run them on group layers.
- Fix bad axis centering on zoom out.
- Export better SVG when exporting paths.
- Tools:
- Text tool: make sure the default color is only changed when
the user confirms the color change.
- Foreground Selection tool: do not create a selection when no
strokes has been made. In particular this removes the
unnecessary delay which happened when switching to another
tool without actually stroking anything.
- All Transform tools: transform boundaries for preview is now
multi-layers aware.
- (Experimental) Seamless Clone tool: made to work again,
though it is still too slow to get out of Playground.
- Graphical User Interface:
- Various improvements to window management:
- Keep-Above windows are set with the Utility hint.
- Utility windows are not made transient to a parent.
- Transient factory dialogs follow the active display,
ensuring that new image windows would not hide your toolbox
and dock windows.
- Various CSS improvements for styling of the interface. Some
theme leaks were also fixed.
- New toggle button in Brushes and Fonts dockable, allowing
brush and font previews to optionally follow the color theme.
For instance, when using a dark theme, the brush and font
previews could be drawn on the theme background, using the
theme foregro
Affected software
openSUSE-SU-2026:20055-1 is recorded against 1 package.
- gimp (fixed in 3.0.6-bp160.1.1)
Timeline and source
Published on 16 January 2026 and last revised on 23 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| gimp | — | 3.0.6-bp160.1.1 |
References
Similar Threats
- Unknown ALSA-2026:50817
- Unknown ALSA-2026:40751
- Unknown ALSA-2026:38496
- Unknown ALSA-2026:19362
- Unknown ALSA-2026:17533
Free Vulnerability Check
Is your site affected by openSUSE-SU-2026:20055-1?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2026:20055-1 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.