Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gzip for openSUSE:Factory checked in at 2026-08-15 22:39:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gzip (Old) and /work/SRC/openSUSE:Factory/.gzip.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gzip" Sat Aug 15 22:39:27 2026 rev:69 rq:1371088 version:1.14 Changes: -------- --- /work/SRC/openSUSE:Factory/gzip/gzip.changes 2026-07-02 20:05:35.553371062 +0200 +++ /work/SRC/openSUSE:Factory/.gzip.new.1258/gzip.changes 2026-08-15 22:39:29.044174154 +0200 @@ -1,0 +2,12 @@ +Thu Aug 13 19:10:30 UTC 2026 - Antonio Teixeira <[email protected]> + +- Fix CVE-2026-41992, global buffer overflow in the LZH decompression logic + (CVE-2026-41992, bsc#1269623, bsc#1272554) + * CVE-2026-41992.patch +- Refresh patches to apply with -p1: + * non-exec-stack.diff + * zdiff.diff + * zgrep.diff +- Use %autosetup to apply patches + +------------------------------------------------------------------- New: ---- CVE-2026-41992.patch ----------(New B)---------- New: (CVE-2026-41992, bsc#1269623, bsc#1272554) * CVE-2026-41992.patch - Refresh patches to apply with -p1: ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gzip.spec ++++++ --- /var/tmp/diff_new_pack.YDftwi/_old 2026-08-15 22:39:30.214215349 +0200 +++ /var/tmp/diff_new_pack.YDftwi/_new 2026-08-15 22:39:30.216215420 +0200 @@ -28,15 +28,17 @@ Source2: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz.sig Source3: %{name}.keyring Patch0: zgrep.diff -Patch2: zmore.diff -Patch3: non-exec-stack.diff -Patch6: zdiff.diff +Patch1: zmore.diff +Patch2: non-exec-stack.diff +Patch3: zdiff.diff # PATCH FIX OPENSUSE BNC#799561 - zgrep silently fails on LZMA compressed files -Patch7: xz_lzma_zstd.patch -Patch8: manpage-no-date.patch -Patch9: gzip-1.14-s390x-errno.patch +Patch4: xz_lzma_zstd.patch +Patch5: manpage-no-date.patch +Patch6: gzip-1.14-s390x-errno.patch # PATCH FIX UPSTREAM bsc#1269622 [email protected] CVE-2026-41991 -Patch10: CVE-2026-41991.patch +Patch7: CVE-2026-41991.patch +# PATCH FIX UPSTREAM bsc#1269623 bsc#1272554 [email protected] CVE-2026-41992 +Patch8: CVE-2026-41992.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: makeinfo @@ -51,15 +53,7 @@ times. %prep -%setup -q -%patch -P 0 -%patch -P 2 -p1 -%patch -P 3 -%patch -P 6 -%patch -P 7 -p1 -%patch -P 8 -p1 -%patch -P 9 -p1 -%patch -P 10 -p1 +%autosetup -p1 %build export CFLAGS="%{optflags} -fomit-frame-pointer \ ++++++ CVE-2026-41992.patch ++++++ commit f75d718fad0263184f273cd5371274c304c55f8c Author: Paul Eggert <[email protected]> Date: Wed Apr 15 12:00:17 2026 -0700 gzip: don’t mishandle .lzh after .Z Problem reported by Michał Majchrowicz. * unlzh.c (read_c_len): Clear left and right when n == 0. * unlzh.c (read_c_len): Move clearing of left and right from here ... (huf_decode_start): ... to here. Problem and fix reported by Elias Hasas. diff --git a/THANKS b/THANKS index 6373fea..c230bed 100644 --- a/THANKS +++ b/THANKS @@ -81,6 +81,7 @@ John Eaton [email protected] Will Edgington [email protected] Brian Edmonds [email protected] Paul Eggert [email protected] +Elias Hasas [email protected] Enami [email protected] Kristoffer Eriksson [email protected] Daniel Eriksson [email protected] @@ -186,6 +187,7 @@ Jamie Lokier [email protected] Richard Lloyd [email protected] David J. MacKenzie [email protected] John R MacMillan [email protected] +Michał Majchrowicz [email protected] Ron Male [email protected] Jakub Martisko [email protected] Don R. Maszle [email protected] diff --git a/unlzh.c b/unlzh.c index 3320196..5605aa0 100644 --- a/unlzh.c +++ b/unlzh.c @@ -307,6 +307,12 @@ decode_p () static void huf_decode_start () { + /* Needed in case LEFT and RIGHT are reused from a previous + LZW decompression. It may be overkill to clear all of both + arrays, but nobody has had time to analyze this carefully. */ + memzero (left, (2 * NC - 1) * sizeof *left); + memzero (right, (2 * NC - 1) * sizeof *right); + init_getbits(); blocksize = 0; } ++++++ non-exec-stack.diff ++++++ --- /var/tmp/diff_new_pack.YDftwi/_old 2026-08-15 22:39:30.333219539 +0200 +++ /var/tmp/diff_new_pack.YDftwi/_new 2026-08-15 22:39:30.337219680 +0200 @@ -1,8 +1,8 @@ -Index: lib/match.c +Index: b/lib/match.c =================================================================== ---- lib/match.c.orig -+++ lib/match.c -@@ -772,3 +772,4 @@ match_init: +--- a/lib/match.c ++++ b/lib/match.c +@@ -771,3 +771,4 @@ match_init: # endif /* __ia64__ */ #endif /* mc68000 || mc68020 */ #endif /* i386 || _I386 */ ++++++ zdiff.diff ++++++ --- /var/tmp/diff_new_pack.YDftwi/_old 2026-08-15 22:39:30.356220349 +0200 +++ /var/tmp/diff_new_pack.YDftwi/_new 2026-08-15 22:39:30.359220455 +0200 @@ -1,8 +1,8 @@ -Index: zdiff.in +Index: b/zdiff.in =================================================================== ---- zdiff.in.orig -+++ zdiff.in -@@ -133,9 +133,9 @@ case $file2 in +--- a/zdiff.in ++++ b/zdiff.in +@@ -132,9 +132,9 @@ case $file2 in 5<&0 then gzip_status=$( ++++++ zgrep.diff ++++++ --- /var/tmp/diff_new_pack.YDftwi/_old 2026-08-15 22:39:30.373220948 +0200 +++ /var/tmp/diff_new_pack.YDftwi/_new 2026-08-15 22:39:30.377221088 +0200 @@ -1,8 +1,8 @@ -Index: zgrep.in +Index: b/zgrep.in =================================================================== ---- zgrep.in.orig -+++ zgrep.in -@@ -211,10 +211,18 @@ res=1 +--- a/zgrep.in ++++ b/zgrep.in +@@ -210,10 +210,18 @@ res=1 for i do
