🛡️ openSUSE-SU-2026:20055-1 — gimp (CVE-2025-10920 +4 more)

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Security update for gimp

This update for gimp fixes the following issues:

Changes in gimp:

Update to 3.0.6:

  • Security:
  • During development, we received reports from the Zero Day

Initiative of potential security issues with some of our file

import plug-ins. While these issues are very unlikely to

occur with real files, developers like Jacob Boerema and Alx

Sa proactively improved security for those imports.

The resolved reports are:

  • ZDI-CAN-27793
  • ZDI-CAN-27823
  • ZDI-CAN-27836
  • ZDI-CAN-27878
  • ZDI-CAN-27863
  • ZDI-CAN-27684
  • Core:
  • Many false-positive build warnings have been cleaned out (and

proper issues fixed).

  • Various crashes fixed.
  • When creating a layer mask from the layer's alpha, but the

layer has no alpha, simply fill the mask with complete

opacity instead of a completely transparent layer.

  • Various core infrastructure code reviewed, cleaned up,

refactored and improved, in drawable, layer and filter

handling code, tree view code, and more.

  • GIMP_ICONS_LIKE_A_BOSS environment variable is not working

anymore (because "gtk-menu-images" and "gtk-button-images"

have been deprecated in GTK3 and removed in GTK4) and was

therefore removed.

  • Lock Content now shows as an undo step.
  • Add alpha channel for certain transforms.
  • Add alpha channel on filter merge, when necessary.
  • Filters can now be applied non-destructively on channels.
  • Improved Photoshop brush support.
  • After deleting a palette entry, the next entry is

automatically selected. This allows easily deleting several

entries in a row, among other usage.

  • Resize image to layers irrespective to selections.
  • Improved in-GUI release notes' demo script language:
  • We can now set a button value to click it: "toolbox:text,

tool-options:outline=1, tool-options:outline-direction"

  • Color selector's module names can be used as identifiers:

"color-editor,color-editor:CMYK=1,color-editor:total-ink-coverage"

  • Fixed Alpha to Selection on single layers with no

transparency.

  • Various code is slowly ported to newer code, preparing for

GTK4 port (in an unplanned future step):

  • Using g_set_str() (optionally redefining it in our core

code to avoid bumping the GLib minimum requirement).

  • Start using GListModel in various pieces of code, in

particular getting rid of more and more usage of

GtkTreeView when possible (as it will be deprecated with

GTK4).

  • New GimpRow class for all future row widgets.
  • Use more of G_DECLARE_DERIVABLE_TYPE and

G_DECLARE_FINAL_TYPE where relevant.

  • New GimpContainerListView using a GtkListBox.
  • New GimpRowSeparator, GimpRowSettings, GimpRowFilter and

GimpRowDrawableFilter widgets.

  • (Experimental) GEX Format was updated.
  • Palette import:
  • Set alpha value for image palette imports.
  • Fix Lab & CMYK ACB palette import.
  • Add palette format filters to import dialog, making it more

apparent what palette formats are supported, and giving the

ability to hide irrelevant files.

  • Improved filter actions' sensitivity to make sure they are

set insensitive when relevant. In particular filters which

cannot be run non-destructively (e.g. filters with aux

inputs, non-interactive filters and GEGL Graph) must be

insensitive when trying to run them on group layers.

  • Fix bad axis centering on zoom out.
  • Export better SVG when exporting paths.
  • Tools:
  • Text tool: make sure the default color is only changed when

the user confirms the color change.

  • Foreground Selection tool: do not create a selection when no

strokes has been made. In particular this removes the

unnecessary delay which happened when switching to another

tool without actually stroking anything.

  • All Transform tools: transform boundaries for preview is now

multi-layers aware.

  • (Experimental) Seamless Clone tool: made to work again,

though it is still too slow to get out of Playground.

  • Graphical User Interface:
  • Various improvements to window management:
  • Keep-Above windows are set with the Utility hint.
  • Utility windows are not made transient to a parent.
  • Transient factory dialogs follow the active display,

ensuring that new image windows would not hide your toolbox

and dock windows.

  • Various CSS improvements for styling of the interface. Some

theme leaks were also fixed.

  • New toggle button in Brushes and Fonts dockable, allowing

brush and font previews to optionally follow the color theme.

For instance, when using a dark theme, the brush and font

previews could be drawn on the theme background, using the

theme foregro

Affected software

openSUSE-SU-2026:20055-1 is recorded against 1 package.

  • gimp (fixed in 3.0.6-bp160.1.1)

Timeline and source

Published on 16 January 2026 and last revised on 23 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
bugzilla.suse.com (Report)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)
www.suse.com (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-01-16
Updated 2026-08-20
Modified 2026-03-23
Fix URL N/A

Affected Packages

Software From version Fixed in
gimp 3.0.6-bp160.1.1

Similar Threats

Free Vulnerability Check

Is your site affected by openSUSE-SU-2026:20055-1?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against openSUSE-SU-2026:20055-1 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesSUSESUSE 2026