Critical GIMP Security Update: Patch CVE-2025-48797 & CVE-2025-48798 Now

 

Urgent GIMP security update fixes critical vulnerabilities (CVE-2025-48797/48798) affecting SUSE Linux and openSUSE. Learn how to patch buffer overflows, use-after-free, and double-free exploits now to protect your system.

Why This Update Matters

A newly released security patch for GNU Image Manipulation Program (GIMP) addresses two high-severity vulnerabilities (CVSS 7.3) that could allow attackers to execute arbitrary code or crash systems via malicious image files.

🔴 Affected Systems:

• openSUSE Leap 15.4/15.6

• SUSE Linux Enterprise Desktop/Server 15 SP6/SP7

• SUSE Real Time, SAP Applications, and Workstation Extension

Threat Level: Important (Exploitable via local access with user privileges)

---

Vulnerability Breakdown

1. CVE-2025-48797: TGA Parser Exploits

• Risk: Heap-based buffer overflow + 2 buffer over-reads

• Impact: Remote code execution via crafted TGA files

• Patch Focus: Memory boundary validation

2. CVE-2025-48798: XCF Parser Flaws

• Risk: Use-after-free (x2) + double-free bugs

• Impact: System crashes or privilege escalation

• Patch Focus: Pointer management fixes

---

How to Patch (Step-by-Step)

For openSUSE Users:

bash

# Leap 15.4  
zypper in -t patch SUSE-2025-2164=1  

# Leap 15.6  
zypper in -t patch openSUSE-SLE-15.6-2025-2164=1  

For SUSE Enterprise Systems:

bash

# Workstation Extension SP6  
zypper in -t patch SUSE-SLE-Product-WE-15-SP6-2025-2164=1  

# Package Hub SP7  
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-2164=1  

Alternative Methods:

• Use YaST Online Update for automated patching.

• Verify updates with zypper patches --cve.

---

Security Best Practices

✅ Verify downloads from official SUSE repositories only.

✅ Audit systems for unauthorized GIMP plugin installations.

✅ Monitor logs for suspicious TGA/XCF file processing.

High-Risk Users: Graphic designers, Linux sysadmins, and open-source developers should prioritize this update.

---

FAQ

Q: Can these vulnerabilities be exploited remotely?

A: No—attackers require local access, but malicious files could spread via phishing.

Q: Does this affect Windows/macOS GIMP builds?

A: Only SUSE-distributed versions are confirmed vulnerable, but upstream patches are recommended.

Q: How critical is immediate patching?

A: High—exploits are publicly documented (CVE/NVD).