[El-errata] ELSA-2026-5113 Important: Oracle Linux 8 gimp:2.8 security update

Wed Mar 25 05:52:10 UTC 2026

Oracle Linux Security Advisory ELSA-2026-5113

http://linux.oracle.com/errata/ELSA-2026-5113.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
gimp-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.x86_64.rpm
gimp-devel-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.x86_64.rpm
gimp-devel-tools-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.x86_64.rpm
gimp-libs-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.x86_64.rpm
pygobject2-2.28.7-5.module+el8.10.0+90497+ae78887f.x86_64.rpm
pygobject2-codegen-2.28.7-5.module+el8.10.0+90497+ae78887f.x86_64.rpm
pygobject2-devel-2.28.7-5.module+el8.10.0+90497+ae78887f.x86_64.rpm
pygobject2-doc-2.28.7-5.module+el8.10.0+90497+ae78887f.x86_64.rpm
pygtk2-2.24.0-25.module+el8.9.0+90151+46a7e4b5.x86_64.rpm
pygtk2-codegen-2.24.0-25.module+el8.9.0+90151+46a7e4b5.x86_64.rpm
pygtk2-devel-2.24.0-25.module+el8.9.0+90151+46a7e4b5.x86_64.rpm
pygtk2-doc-2.24.0-25.module+el8.9.0+90151+46a7e4b5.noarch.rpm
python2-cairo-1.16.3-7.module+el8.10.0+90497+ae78887f.x86_64.rpm
python2-cairo-devel-1.16.3-7.module+el8.10.0+90497+ae78887f.x86_64.rpm

aarch64:
gimp-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.aarch64.rpm
gimp-devel-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.aarch64.rpm
gimp-devel-tools-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.aarch64.rpm
gimp-libs-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.aarch64.rpm
pygobject2-2.28.7-5.module+el8.10.0+90497+ae78887f.aarch64.rpm
pygobject2-codegen-2.28.7-5.module+el8.10.0+90497+ae78887f.aarch64.rpm
pygobject2-devel-2.28.7-5.module+el8.10.0+90497+ae78887f.aarch64.rpm
pygobject2-doc-2.28.7-5.module+el8.10.0+90497+ae78887f.aarch64.rpm
pygtk2-2.24.0-25.module+el8.9.0+90151+46a7e4b5.aarch64.rpm
pygtk2-codegen-2.24.0-25.module+el8.9.0+90151+46a7e4b5.aarch64.rpm
pygtk2-devel-2.24.0-25.module+el8.9.0+90151+46a7e4b5.aarch64.rpm
pygtk2-doc-2.24.0-25.module+el8.9.0+90151+46a7e4b5.noarch.rpm
python2-cairo-1.16.3-7.module+el8.10.0+90497+ae78887f.aarch64.rpm
python2-cairo-devel-1.16.3-7.module+el8.10.0+90497+ae78887f.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/gimp-2.8.22-26.module+el8.10.0+90845+49de5bf7.5.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/pygobject2-2.28.7-5.module+el8.10.0+90497+ae78887f.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/pygtk2-2.24.0-25.module+el8.9.0+90151+46a7e4b5.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/python2-pycairo-1.16.3-7.module+el8.10.0+90497+ae78887f.src.rpm

Related CVEs:

CVE-2026-0797
CVE-2026-2044
CVE-2026-2045
CVE-2026-2048

Description of changes:

gimp
[2:2.8.22-26.5]
- fix CVE-2026-0797
- fix CVE-2026-2044
- fix CVE-2026-2045
- fix CVE-2026-2048

[2:2.8.22-26.4]
- fix CVE-2025-14422

[2:2.8.22-26.3]
- fix CVE-2025-10920
- fix CVE-2025-10921
- fix CVE-2025-10922
- fix CVE-2025-10923
- fix CVE-2025-10924
- fix CVE-2025-10925
- fix CVE-2025-10934

[2:2.8.22-26.2]
- fix CVE-2025-5473 (RHEL-95696)

[2:2.8.22-26.1]
- fix CVE-2025-48797 (RHEL-93503)
- fix CVE-2025-48798 (RHEL-93506)

[2:2.28.22-26]
- bump spec

[2:2.8.22-25]
- fix CVE-2023-44442
- fix CVE-2023-44444
- disable gimp-2.8.22-python-path.patch required for flatpak
- partially cherry-pick from upstream commit 2987f012 to fix fclose leak
  Resolves: RHEL-17048 RHEL-17060

[2:2.8.22-24]
- fallback to RPM gegl

[2:2.8.22-23]
- enforce gegl04

[2:2.8.22-22]
- change gegl requirement to  gegl04

pygobject2
[2.28.7-5]
- bump spec to fix NVR

[2.28.7-4]
- update python macro to python2

[2.28.7-3]
- Add MIT license

[2.28.7-2.1]
- Fix python shebangs (#1580854)

[2.28.7-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.28.7-1]
- Update to 2.28.7

[2.28.6-19]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

[2.28.6-18]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.28.6-17]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.28.6-16]
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages

pygtk2
[2.24.0-25]
- Fix shebang mangling for _prefix=app (#1907579)
- disable numpy for flatpak (#1907579)

[2.24.0-24]
- remove libglade dependency and sub-package (#1622134)

[2.24.0-23.1]
- fix python2 regex in sed command

[2.24.0-23]
- resotre doc sub package

[2.24.0-22]
- fix python2 macros

[2.24.0-21.1]
- Fix python shebangs (#1580855)

[2.24.0-21]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.24.0-20]
- Try again to fix shebangs

[2.24.0-19]
- Fix shebangs

[2.24.0-18]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

python2-pycairo
[1.16.3-7]
- bump spec for NVR fix

[1.16.3-6]
- Rename pycairo to python2-pycairo (RCM-39388)

[1.16.3-5]
- Add python3 packages (RCM-39388)
- remove python3-test due its missing in build root

[1.16.3-4]
- Setup python2 stream branch for python2 binding of cairo library

[1.16.3-3]
- Remove the python2 subpackages
  https://bugzilla.redhat.com/show_bug.cgi?id=1590820

[1.16.3-2]
- Allow Python 2 for build
  See: https://hurl.corp.redhat.com/rhel8-py2

- Skip tests on Python 2 (python2-pytest is being removed)

[1.16.3-1]
- Update to 1.16.3

[1.16.1-1]
- Update to 1.16.1

[1.16.0-1]
- Update to 1.16.0

[1.15.6-1]
- Update to 1.15.6