DEBIAN-CVE-2025-6035

A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insufficient memory and subsequently performing out-of-bounds writes. This issue could lead to heap corruption, a potential denial of service (DoS), or arbitrary code execution in certain scenarios.

References

https://security-tracker.debian.org/tracker/CVE-2025-6035

Affected packages

Debian:12 / gimp

Package

Name: gimp
Purl: pkg:deb/debian/gimp?arch=source&distro=bookworm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.10.34-1+deb12u4

Affected versions

2.*

2.10.34-1

2.10.34-1+deb12u1

2.10.34-1+deb12u2

2.10.34-1+deb12u3

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-6035.json"

Debian:13 / gimp

Package

Name: gimp
Purl: pkg:deb/debian/gimp?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.4-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-6035.json"

Debian:14 / gimp

Package

Name: gimp
Purl: pkg:deb/debian/gimp?arch=source&distro=forky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.0.4-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-6035.json"