Hi, On Thu, Sep 17, 2026 at 08:52:13AM +0200, Salvatore Bonaccorso wrote: > Hi Mark, > > On Sun, Sep 06, 2026 at 09:02:48PM +0200, Salvatore Bonaccorso wrote: > > Source: zlib > > Version: 1:1.3.dfsg+really1.3.2-1 > > Severity: grave > > Tags: security upstream > > Justification: user security hole > > X-Debbugs-Cc: [email protected], Debian Security Team > > <[email protected]> > > > > Hi, > > > > The following vulnerability was published for zlib. > > > > CVE-2026-85091[0]: > > | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow > > | vulnerability in the gz_vacate() function when processing non- > > | blocking gzwrite() operations with stale external buffer pointers. > > | Attackers can trigger the overflow by calling gzprintf() or > > | gzvprintf() after a write stall, causing an unchecked memmove() to > > | write beyond the internal input buffer boundary. > > > > > > If you fix the vulnerability please also make sure to include the > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > Attached is a proposed update for zlib in unstable with one related > patch cherry-picked and the upstream commited change for > CVE-2026-85091.
And now attached for real :-( Regards, Salvatore
diff -Nru zlib-1.3.dfsg+really1.3.2/debian/changelog zlib-1.3.dfsg+really1.3.2/debian/changelog --- zlib-1.3.dfsg+really1.3.2/debian/changelog 2026-04-01 23:50:49.000000000 +0200 +++ zlib-1.3.dfsg+really1.3.2/debian/changelog 2026-09-17 08:36:08.000000000 +0200 @@ -1,3 +1,12 @@ +zlib (1:1.3.dfsg+really1.3.2-3.1) unstable; urgency=medium + + * Non-maintainer upload. + * Avoid undefined behavior in gzwrite.c + * Fix buffer overflow bug in non-blocking gzwrite (CVE-2026-85091) + (Closes: #1146895) + + -- Salvatore Bonaccorso <[email protected]> Thu, 17 Sep 2026 08:36:08 +0200 + zlib (1:1.3.dfsg+really1.3.2-3) unstable; urgency=low * Suppress crcvx to fix building of minizip on s390 with patch diff -Nru zlib-1.3.dfsg+really1.3.2/debian/patches/Avoid-undefined-behavior-in-gzwrite.c.patch zlib-1.3.dfsg+really1.3.2/debian/patches/Avoid-undefined-behavior-in-gzwrite.c.patch --- zlib-1.3.dfsg+really1.3.2/debian/patches/Avoid-undefined-behavior-in-gzwrite.c.patch 1970-01-01 01:00:00.000000000 +0100 +++ zlib-1.3.dfsg+really1.3.2/debian/patches/Avoid-undefined-behavior-in-gzwrite.c.patch 2026-09-17 08:32:47.000000000 +0200 @@ -0,0 +1,27 @@ +From: Mark Adler <[email protected]> +Date: Sun, 5 Apr 2026 15:14:04 -0700 +Subject: Avoid undefined behavior in gzwrite.c. +Origin: https://github.com/madler/zlib/commit/e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca + +Adding to NULL is undefined. +--- + gzwrite.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/gzwrite.c b/gzwrite.c +index 13a3700a83c7..b5026e5fadde 100644 +--- a/gzwrite.c ++++ b/gzwrite.c +@@ -383,7 +383,8 @@ local int gz_vacate(gz_statep state) { + z_streamp strm; + + strm = &(state->strm); +- if (strm->next_in + strm->avail_in <= state->in + state->size) ++ if (strm->next_in == NULL || ++ strm->next_in + strm->avail_in <= state->in + state->size) + return 0; + (void)gz_comp(state, Z_NO_FLUSH); + if (strm->avail_in == 0) { +-- +2.55.0 + diff -Nru zlib-1.3.dfsg+really1.3.2/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch zlib-1.3.dfsg+really1.3.2/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch --- zlib-1.3.dfsg+really1.3.2/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch 1970-01-01 01:00:00.000000000 +0100 +++ zlib-1.3.dfsg+really1.3.2/debian/patches/Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch 2026-09-17 08:35:19.000000000 +0200 @@ -0,0 +1,32 @@ +From: Mark Adler <[email protected]> +Date: Wed, 16 Sep 2026 16:26:14 -0700 +Subject: Fix buffer overflow bug in non-blocking gzwrite. +Origin: https://github.com/madler/zlib/commit/df84af25dc1942490e1d1c899a07619152a46148 +Bug-Debian: https://bugs.debian.org/1146895 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-85091 + +This addresses CVE-2026-85091. +--- + gzwrite.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/gzwrite.c b/gzwrite.c +index b217b85cefdb..512329244590 100644 +--- a/gzwrite.c ++++ b/gzwrite.c +@@ -242,8 +242,11 @@ local z_size_t gz_write(gz_statep state, voidpc buf, z_size_t len) { + n -= state->strm.avail_in; + state->x.pos += n; + len -= n; +- if (ret == -1) ++ if (ret == -1) { ++ state->strm.avail_in = 0; ++ state->strm.next_in = state->in; + return state->again ? put - len : 0; ++ } + } while (len); + } + +-- +2.55.0 + diff -Nru zlib-1.3.dfsg+really1.3.2/debian/patches/series zlib-1.3.dfsg+really1.3.2/debian/patches/series --- zlib-1.3.dfsg+really1.3.2/debian/patches/series 2026-03-30 01:02:50.000000000 +0200 +++ zlib-1.3.dfsg+really1.3.2/debian/patches/series 2026-09-17 08:35:26.000000000 +0200 @@ -1,2 +1,4 @@ minizip-headers.patch minizip-ldadd.patch +Avoid-undefined-behavior-in-gzwrite.c.patch +Fix-buffer-overflow-bug-in-non-blocking-gzwrite.patch
