huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-11468: cpython: Missing character filtering in Python
Component: cpython
Severity: Moderate
CWE: CWE-140 (Improper Neutralization of Delimiters)
CVSS v3: 4.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N)
Public date: 2026-01-20T21:09:11.229000+00:00

Missing character filtering has been discovered in Python. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.


Affected upstream versions: 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.12, 3.14.0 < 3.14.3, 3.15.0a1 < 3.15.0a6
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2
CVE-2025-11494: binutils: GNU Binutils Linker out-of-bounds read
Component: binutils
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-08T19:32:07.225000+00:00

An out of bounds read flaw has been discovered in the GNU Binutils package. The impacted function is _bfd_x86_elf_late_size_sections of the file bfd/elfxx-x86.c of the component Linker. The manipulation results in out-of-bounds read. The attack needs to be approached locally.

Statement: Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.

Affected upstream versions: 2.45
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a
CVE-2025-11495: binutils: GNU Binutils Linker heap-based overflow
Component: binutils
Severity: Low
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-08T20:02:07.807000+00:00

A heap based buffer overflow flaw has been discovered in the GNU Binutils package. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally.

Statement: Red Hat rates this vulnerability as Low as a result of how the GNU Binutils are configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the availability impact of this flaw will be restricted.

Affected upstream versions: 2.45
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0
CVE-2025-11538: keycloak-server: Debug default bind address
Component: keycloak-server
Severity: Moderate
CWE: CWE-1327 (Binding to an Unrestricted IP Address)
CVSS v3: 6.8 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-11-13T15:00:00+00:00

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.

Statement: Red Hat evaluates this as a Moderate impact vulnerability due to the requirement of running debug mode and untrusted network.
Also, for Red Hat Single Sign-On, this must as well be bound to 0.0.0.0 address, which is not recommended in production scenarios.

Affected upstream versions: <= 1.3.0.Final
Fixed upstream versions: 26.4-3, 26.4.4, 26.4.4-1
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 9e98f2bf961f68853cea6fbec58b512ed8be7ca9
CVE-2025-11621: github.com/hashicorp/vault: Vault AWS auth method bypass due to AWS client cache
Component: github.com/hashicorp/vault
Severity: Important
CWE: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-10-23T19:08:54.989000+00:00

An authentication bypass flaw has been discovered in Hashicorp's vault product. Vault's AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard.


Affected upstream versions: 0.6.0 < 1.21.0, 0.6.0 < 1.21.0
Fixed upstream versions: 1.21.0
Upstream repository: https://github.com/hashicorp/vault
Upstream fix commit: 054c35de0c830fd7cb9991bec8b0e6a0c793e98d
CVE-2025-11678: libwebsockets: Stack-based Buffer Overflow in libwebsockets
Component: libwebsockets
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2025-10-20T13:51:17.328000+00:00

A stack based buffer overflow flaw has been discovered in libwebsockets. The vulnerability allows an attacker that can inspect DNS requests made by the victim (e.g. being in the same wireless network) to forge a DNS response packet that overflows the stack and may lead to arbitrary code execution.


Affected upstream versions: 4.0 <= 4.4.2, 4.0 <= 4.3.6
Upstream repository: https://libwebsockets.org/git/libwebsockets
Upstream fix commit: 2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a
CVE-2025-12044: github.com/hashicorp/vault: Vault Vulnerable to Denial of Service Due to Rate Limit Regression
Component: github.com/hashicorp/vault
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-23T19:15:16.567000+00:00

A denial of service flaw has been discovered in Hashicorp's vault product. Vault is vulnerable to an unauthenticated denial of service when processing JSON payloads. This occurs due to a regression from a previous fix for HCSEC-2025-24 which allowed for processing JSON payloads before applying rate limits.


Affected upstream versions: 1.20.3 < 1.21.0, 1.20.3 < 1.21.0, 1.19.9 < 1.19.11, 1.18.14 < 1.18.15, 1.16.25 < 1.16.27
Fixed upstream versions: 1.16.27, 1.18.15, 1.19.11, 1.21.0
Upstream repository: https://github.com/hashicorp/vault
Upstream fix commit: 0adb749a82071ac312d05aef8bc0fe79b6ad49a6
CVE-2025-12084: cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service
Component: cpython
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-03T18:55:32.222000+00:00

A flaw was found in cpython. This vulnerability allows impacted availability via a quadratic algorithm in `xml.dom.minidom` methods, such as `appendChild()`, when building excessively nested documents due to a dependency on `_clear_id_cache()`

Statement: This vulnerability is rated Important for Red Hat products as it can lead to a denial of service. The flaw exists in the `xml.dom.minidom` module of cpython, where a quadratic algorithm in methods like `appendChild()` can be triggered when processing excessively nested XML documents. When successfully exploited this may impact the availability of applications utilizing this functionality across affected Red Hat products.

Affected upstream versions: 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.11, 3.14.0 < 3.14.2, 3.15.0a1 < 3.15.0a3
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 08d8e18ad81cd45bc4a27d6da478b51ea49486e4
CVE-2025-1244: emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme
Component: emacs
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-02-12T00:00:00+00:00

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.

Statement: To exploit this flaw, an attacker needs to trick a user into visiting a specially crafted website, an HTTP URL with a redirect or in general a custom man URI schemes. In order to exploit this vulnerability a user action is required, limiting the possibility of this issue to be exploited.

Fixed upstream versions: 1.3.1-1741784043, 1:24.3-23.el7_9.2, 1:26.1-10.el8_8.7, 1:26.1-13.el8_10, 1:26.1-5.el8_2.3, 1:26.1-5.el8_4.3, 1:26.1-7.el8_6.6, 1:27.2-10.el9_4.1, 1:27.2-11.el9_5.1, 1:27.2-6.el9_0.2, 1:27.2-8.el9_2.2, 29.4.0
Upstream repository: https://git.savannah.gnu.org/cgit/emacs.git
Upstream fix commit: 820f0793f0b46448928905552726c1f1b999062f
CVE-2025-12638: keras: Path Traversal Vulnerability in keras
Component: keras
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.6 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L)
Public date: 2025-11-28T14:06:02.069000+00:00

A path traversal flaw has been discovered in Keras. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory.


Affected upstream versions: unspecified <= latest
Fixed upstream versions: v3.12.0
Upstream repository: https://github.com/keras-team/keras
Upstream fix commit: 47fcb397ee4caffd5a75efd1fa3067559594e951
CVE-2025-13033: nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Component: nodemailer
Severity: Moderate
CWE: CWE-1286 (Improper Validation of Syntactic Correctness of Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-10-07T13:42:02+00:00

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the email to the attacker's external address instead of the intended internal recipient. This could lead to a significant data leak of sensitive information and allow an attacker to bypass security filters and access controls.

Statement: This vulnerability allows an attacker to force nodemailer to send an email to an attacker-owned email address by leveraging the incorrect handling of quoted local-parts containing the '@' character in the destination email address. When successfully exploited, this vulnerability may allow an attacker to exfiltrate data by misrouting emails to an unintended domain, presenting a high impact on data confidentiality.

This vulnerability has been assessed as having a Moderate impact on Red Hat Products by the Red Hat Product Security team. This is because for an attacker successfully exploit this vulnerability, the malicious actor needs to have direct control over the destination email input.

Affected upstream versions: <= v7.0.6
Fixed upstream versions: 1772573159, 1777566546, 7.0.7
Upstream repository: https://github.com/nodemailer/nodemailer
Upstream fix commit: 1150d99fba77280df2cfb1885c43df23109a8626
CVE-2025-13462: cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues
Component: cpython
Severity: Low
CWE: CWE-237 (Improper Handling of Structural Elements)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2026-03-12T17:59:26.620000+00:00

A flaw was found in the `tarfile` module of cpython. This vulnerability allows a remote attacker to craft a malicious tar archive that, when processed, could be misinterpreted by the `tarfile` module. This misinterpretation occurs because the module incorrectly applies normalization of `AREGTYPE` blocks to `DIRTYPE` during the processing of multi-block members, such as `GNUTYPE_LONGNAME` or `GNUTYPE_LONGLINK`. The consequence is that the `tarfile` module may process the archive differently than intended, potentially leading to unexpected file system changes or data integrity issues.

Statement: A Low-impact flaw in Python’s tarfile module mishandles multi-block members. A local attacker could use a crafted tar archive to cause minor data integrity issues or unexpected file system changes under specific, high-complexity conditions.

Affected upstream versions: 3.14.0 < 3.14.4, 3.15.0a1 < 3.15.0a8
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 42d754e34c06e57ad6b8e7f92f32af679912d8ab
CVE-2025-13467: org.keycloak.storage.ldap: Keycloak: Deserialization of Untrusted Data in LDAP User Federation
Component: org.keycloak.storage.ldap
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
Public date: 2025-11-25T00:00:00+00:00

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.


Affected upstream versions: <= 1.3.0.Final
Fixed upstream versions: 26.2-12, 26.2.11-1, 26.4-5, 26.4-6, 26.4.6, 26.4.6-1
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 754c070cf8ca187dcc71f0f72ff3130ff2195328
CVE-2025-13499: wireshark: Access of Uninitialized Pointer in Wireshark
Component: wireshark
Severity: Important
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2025-11-21T06:03:52.020000+00:00

An uninitialized pointer access has been discovered in Wireshark. An attacker who can provide crafted input may be able to leverage this pointer access weakness to crash the application.


Affected upstream versions: 4.6.0, 4.4.0 < 4.4.11
Fixed upstream versions: 4.4.11
Upstream repository: https://gitlab.com/wireshark/wireshark
Upstream fix commit: 49137f8ce93c9f7ac55b69c8e089ba6a422f633e
CVE-2025-13836: cpython: Excessive read buffering DoS in http.client
Component: cpython
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2025-12-01T18:02:38.483000+00:00

A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.

Statement: This issue can only be exploited by Python applications using the http.client.HTTPResponse.read function without the amount parameter, which specifies the read size in bytes. Note that Python libraries may use this function internally and make applications vulnerable. Additionally, vulnerable Python applications must connect to a malicious or compromised server that replies with a very large or crafted Content-Length header to trigger this issue, limiting the exposure of this vulnerability.

Affected upstream versions: 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.11, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a3
Fixed upstream versions: v3.14.1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 4ce27904b597c77d74dd93f2c912676021a99155
CVE-2025-13837: cpython: Out-of-memory when loading Plist
Component: cpython
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H)
Public date: 2025-12-01T18:13:32.739000+00:00

A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations errors, swapping, out-of-memory conditions or even system freezes.

Statement: This issue can only be exploited by Python applications processing malicious or untrusted Plist files, which are not typically done in Linux systems or applications. Furthermore, this flaw can cause only a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.

Affected upstream versions: 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a3
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 694922cf40aa3a28f898b5f5ee08b71b4922df70
CVE-2025-13888: openshift-gitops-operator: OpenShift GitOps: Namespace Admin Cluster Takeover via Privileged Jobs
Component: openshift-gitops-operator
Severity: Important
CWE: CWE-266 (Incorrect Privilege Assignment)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2025-12-15T13:00:00+00:00

A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions in other namespaces, including privileged namespaces. An authenticated attacker can then use these elevated permissions to create privileged workloads that run on master nodes, effectively giving them root access to the entire cluster.

Statement: Red Hat rates this vulnerability as Important instead of Critical. While full cluster compromise is possible, it requires the attacker to already possess authenticated namespace administrator credentials, reducing the attack surface to authorized internal users rather than external attackers.

Affected upstream versions: <= v1.16.1
Fixed upstream versions: 1.16.2, sha256:27e7a59bb5c5f60be7509e5f4f07f4181d62e6583a943c46f56f568bfc30c2c1, sha256:3eb6308c58365182b4b5b5aabf35754d821e25b8a04b0595900fb47d52cd3ecc, sha256:43ba408b8ed58259bf338fd29260d936fbde9846f772d0580b3e7486ef8ea300, sha256:c41c99f360a2515bce55c42e309e2c72500ba66d3a2c461412dee7de5ea9a9fa
Upstream repository: https://github.com/redhat-developer/gitops-operator
Upstream fix commit: bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef
CVE-2025-14422: gimp: GIMP: Remote Code Execution via PNM file parsing integer overflow
Component: gimp
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-12-23T21:31:13.262000+00:00

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability during the parsing of a malicious PNM (Portable Anymap) image file. This issue stems from insufficient validation of user-supplied data, which can lead to an integer overflow before memory allocation. Successful exploitation requires user interaction, such as opening a specially crafted file, and could result in arbitrary code execution within the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it allows remote code execution in GIMP through an integer overflow when parsing a malicious PNM image file. Exploitation requires user interaction, specifically opening a specially crafted PNM file.

Affected upstream versions: 3.0.6
Fixed upstream versions: GIMP_3_2_0
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 4ff2d773d58064e6130495de498e440f4a6d5edb
CVE-2025-14423: gimp: GIMP: Remote Code Execution via stack-based buffer overflow in LBM file parsing
Component: gimp
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-12-23T21:31:23.374000+00:00

A flaw was found in GIMP. This stack-based buffer overflow vulnerability occurs during the parsing of LBM files due to insufficient validation of user-supplied data length. A remote attacker can exploit this by tricking a user into opening a specially crafted malicious LBM file. Successful exploitation could lead to arbitrary code execution in the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it allows for remote code execution in GIMP. Exploitation requires user interaction, specifically tricking a user into opening a specially crafted malicious LBM file.

Affected upstream versions: 3.0.6
Fixed upstream versions: GIMP_3_2_0
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 481cdbbb97746be1145ec3a633c567a68633c521
CVE-2025-14424: gimp: GIMP: Remote Code Execution via XCF File Parsing Use-After-Free
Component: gimp
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-12-23T21:31:33.530000+00:00

A flaw was found in GIMP. This use-after-free vulnerability in the XCF file parsing component allows a remote attacker to execute arbitrary code. Successful exploitation requires user interaction, where a target must open a specially crafted malicious XCF file. This can lead to the execution of unauthorized code in the context of the current process.

Statement: This vulnerability is rated Important for Red Hat products as it allows for remote code execution in GIMP. Exploitation requires user interaction, specifically opening a specially crafted malicious XCF file.

Affected upstream versions: 3.0.6
Fixed upstream versions: GIMP_3_2_0
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 5cc55d078b7fba995cef77d195fac325ee288ddd
CVE-2025-14425: gimp: GIMP: Remote Code Execution via JP2 file parsing heap-based buffer overflow
Component: gimp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-12-23T21:31:42.424000+00:00

A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the JP2 file parsing component allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, where the target must open a specially crafted malicious JP2 file. Successful exploitation can lead to complete control over the affected system.

Statement: This vulnerability is rated Important for Red Hat as it allows remote code execution via a heap-based buffer overflow in GIMP's JP2 file parsing component. Exploitation requires user interaction, where a user must open a specially crafted malicious JP2 file.

Affected upstream versions: 3.0.6
Fixed upstream versions: GIMP_3_2_0
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: cd1c88a0364ad1444c06536731972a99bd8643fd