diff --git a/SOURCES/3126.patch b/SOURCES/3126.patch
index 4bd6a17..00faa3a 100644
--- a/SOURCES/3126.patch
+++ b/SOURCES/3126.patch
@@ -3019,3 +3019,18 @@ index 871a6dab0..143057de7 100644
static void
--
2.40.0
+diff --git a/docs/reference/glib/glib-docs.xml b/docs/reference/glib/glib-docs.xml
+index 2f5de9e31..987179544 100644
+--- a/docs/reference/glib/glib-docs.xml
++++ b/docs/reference/glib/glib-docs.xml
+@@ -292,6 +292,10 @@
+ Index of new symbols in 2.70
+
+
++
++ Index of new symbols in 2.74
++
++
+
+
+
diff --git a/SOURCES/5247.patch b/SOURCES/5247.patch
new file mode 100644
index 0000000..2d61379
--- /dev/null
+++ b/SOURCES/5247.patch
@@ -0,0 +1,50 @@
+From 23dbc305bd72cdab572b92cf55ba3375369f74ac Mon Sep 17 00:00:00 2001
+From: Joan Torres Lopez
+Date: Mon, 13 Jul 2026 21:46:02 +0200
+Subject: [PATCH] gdbusnameowning: Downgrade ReleaseName warning on closed
+ connection to debug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+g_bus_unown_name() calls ReleaseName synchronously after checking that
+the connection is still open. However, the connection can close on the
+worker thread between the check and the call, which commonly happens
+during session shutdown when the bus daemon exits while clients are
+still running cleanup code.
+
+When this race occurs, the ReleaseName call fails with G_IO_ERROR_CLOSED
+and produces a spurious warning in the journal. Downgrade to g_debug
+since the name release is best-effort — the bus daemon is gone, so the
+name is already unowned.
+---
+ gio/gdbusnameowning.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/gio/gdbusnameowning.c b/gio/gdbusnameowning.c
+index c66e6813e..4f26cb09b 100644
+--- a/gio/gdbusnameowning.c
++++ b/gio/gdbusnameowning.c
+@@ -29,6 +29,7 @@
+ #include "gdbuserror.h"
+ #include "gdbusprivate.h"
+ #include "gdbusconnection.h"
++#include "gioerror.h"
+
+ #include "glibintl.h"
+
+@@ -942,7 +943,10 @@ g_bus_unown_name (guint owner_id)
+ &error);
+ if (result == NULL)
+ {
+- g_warning ("Error releasing name %s: %s", client->name, error->message);
++ if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CLOSED))
++ g_debug ("Error releasing name %s: %s", client->name, error->message);
++ else
++ g_warning ("Error releasing name %s: %s", client->name, error->message);
+ g_error_free (error);
+ }
+ else
+--
+2.51.0
+
diff --git a/SOURCES/CVE-2025-14087.patch b/SOURCES/CVE-2025-14087.patch
new file mode 100644
index 0000000..8036338
--- /dev/null
+++ b/SOURCES/CVE-2025-14087.patch
@@ -0,0 +1,566 @@
+From e8e8b447de4211564d90e5da975eb4fa8ee37fc9 Mon Sep 17 00:00:00 2001
+From: Philip Withnall
+Date: Tue, 25 Nov 2025 19:27:51 +0000
+Subject: [PATCH 1/4] gutf8: Add tests and clarify documentation for
+ g_unichar_to_utf8()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While using `g_unichar_to_utf8()`, I noticed the return type is `int`,
+which suggests that it could return negative values. Wanting to make
+sure I properly handled this in my code, I checked the implementation of
+`g_unichar_to_utf8()` and found that it can actually only return [1, 6].
+
+It looks like the `int` return type is a historical C-ism, and it should
+really return an unsigned integer type.
+
+Improve the docs and add some unit tests while I’m there.
+
+Signed-off-by: Philip Withnall
+---
+ glib/gutf8.c | 8 ++++----
+ glib/tests/unicode.c | 35 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 39 insertions(+), 4 deletions(-)
+
+diff --git a/glib/gutf8.c b/glib/gutf8.c
+index 5a875ce26..d24aa246f 100644
+--- a/glib/gutf8.c
++++ b/glib/gutf8.c
+@@ -537,16 +537,16 @@ g_utf8_truncate_middle (const gchar *string,
+ *
+ * Converts a single character to UTF-8.
+ *
+- * Returns: number of bytes written
++ * Returns: number of bytes written, guaranteed to be in the range [1, 6]
+ */
+ int
+ g_unichar_to_utf8 (gunichar c,
+ gchar *outbuf)
+ {
+ /* If this gets modified, also update the copy in g_string_insert_unichar() */
+- guint len = 0;
+- int first;
+- int i;
++ size_t len = 0;
++ char first;
++ size_t i;
+
+ if (c < 0x80)
+ {
+diff --git a/glib/tests/unicode.c b/glib/tests/unicode.c
+index cb74068a5..cae8fd175 100644
+--- a/glib/tests/unicode.c
++++ b/glib/tests/unicode.c
+@@ -1410,6 +1410,40 @@ test_wide (void)
+ }
+ };
+
++/* Test g_unichar_to_utf8(). */
++static void
++test_unichar_to_utf8 (void)
++{
++ const struct
++ {
++ gunichar unichar;
++ int expected_length;
++ const char *expected_output; /* must be of length `expected_length` */
++ }
++ vectors[] =
++ {
++ { 0x21, 1, "!" },
++ { 0x00A1, 2, "\xc2\xa1" },
++ { 0x0800, 3, "\xe0\xa0\x80" },
++ { 0x10000, 4, "\xf0\x90\x80\x80" },
++ { 0x200000, 5, "\xf8\x88\x80\x80\x80" },
++ { 0x4000000, 6, "\xfc\x84\x80\x80\x80\x80" },
++ };
++
++ for (size_t i = 0; i < G_N_ELEMENTS (vectors); i++)
++ {
++ int length;
++ char output[6];
++
++ length = g_unichar_to_utf8 (vectors[i].unichar, NULL);
++ g_assert_cmpint (length, ==, vectors[i].expected_length);
++
++ length = g_unichar_to_utf8 (vectors[i].unichar, output);
++ g_assert_cmpint (length, ==, vectors[i].expected_length);
++ g_assert_cmpmem (output, length, vectors[i].expected_output, vectors[i].expected_length);
++ }
++}
++
+ /* Test that g_unichar_compose() returns the correct value for various
+ * ASCII and Unicode alphabetic, numeric, and other, codepoints. */
+ static void
+@@ -1987,6 +2021,7 @@ main (int argc,
+ g_test_add_func ("/unicode/upper", test_upper);
+ g_test_add_func ("/unicode/validate", test_unichar_validate);
+ g_test_add_func ("/unicode/wide", test_wide);
++ g_test_add_func ("/unicode/unichar-to-utf8", test_unichar_to_utf8);
+ g_test_add_func ("/unicode/xdigit", test_xdigit);
+ g_test_add_func ("/unicode/xdigit-value", test_xdigit_value);
+ g_test_add_func ("/unicode/zero-width", test_zerowidth);
+--
+2.53.0
+
+
+From 4271cf7f93ab49e8bc05e1d31ae2922fa2845cfe Mon Sep 17 00:00:00 2001
+From: Philip Withnall
+Date: Tue, 25 Nov 2025 19:02:56 +0000
+Subject: [PATCH 2/4] gvariant-parser: Fix potential integer overflow parsing
+ (byte)strings
+
+The termination condition for parsing string and bytestring literals in
+GVariant text format input was subject to an integer overflow for input
+string (or bytestring) literals longer than `INT_MAX`.
+
+Fix that by counting as a `size_t` rather than as an `int`. The counter
+can never correctly be negative.
+
+Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
+from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
+
+Signed-off-by: Philip Withnall
+Fixes: #3834
+---
+ glib/gvariant-parser.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
+index 112d89da7..560562446 100644
+--- a/glib/gvariant-parser.c
++++ b/glib/gvariant-parser.c
+@@ -597,7 +597,7 @@ ast_resolve (AST *ast,
+ {
+ GVariant *value;
+ gchar *pattern;
+- gint i, j = 0;
++ size_t i, j = 0;
+
+ pattern = ast_get_pattern (ast, error);
+
+@@ -1621,9 +1621,9 @@ string_free (AST *ast)
+ * No leading/trailing space allowed. */
+ static gboolean
+ unicode_unescape (const gchar *src,
+- gint *src_ofs,
++ size_t *src_ofs,
+ gchar *dest,
+- gint *dest_ofs,
++ size_t *dest_ofs,
+ gsize length,
+ SourceRef *ref,
+ GError **error)
+@@ -1684,7 +1684,7 @@ string_parse (TokenStream *stream,
+ gsize length;
+ gchar quote;
+ gchar *str;
+- gint i, j;
++ size_t i, j;
+
+ token_stream_start_ref (stream, &ref);
+ token = token_stream_get (stream);
+@@ -1814,7 +1814,7 @@ bytestring_parse (TokenStream *stream,
+ gsize length;
+ gchar quote;
+ gchar *str;
+- gint i, j;
++ size_t i, j;
+
+ token_stream_start_ref (stream, &ref);
+ token = token_stream_get (stream);
+--
+2.53.0
+
+
+From 8c96e5b9b96d44458549a6798fa10a841eb65e84 Mon Sep 17 00:00:00 2001
+From: Philip Withnall
+Date: Tue, 25 Nov 2025 19:19:16 +0000
+Subject: [PATCH 3/4] gvariant-parser: Use size_t to count numbers of child
+ elements
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Rather than using `gint`, which could overflow for arrays (or dicts, or
+tuples) longer than `INT_MAX`. There may be other limits which prevent
+parsed containers becoming that long, but we might as well make the type
+system reflect the programmer’s intention as best it can anyway.
+
+For arrays and tuples this is straightforward. For dictionaries, it’s
+slightly complicated by the fact that the code used
+`dict->n_children == -1` to indicate that the `Dictionary` struct in
+question actually represented a single freestanding dict entry. In
+GVariant text format, that would be `{1, "one"}`.
+
+The implementation previously didn’t define the semantics of
+`dict->n_children < -1`.
+
+Now, instead, change `Dictionary.n_children` to `size_t`, and define a
+magic value `DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY` to indicate that
+the `Dictionary` represents a single freestanding dict entry.
+
+This magic value is `SIZE_MAX`, and given that a dictionary entry takes
+more than one byte to represent in GVariant text format, that means it’s
+not possible to have that many entries in a parsed dictionary, so this
+magic value won’t be hit by a normal dictionary. An assertion checks
+this anyway.
+
+Spotted while working on #3834.
+
+Signed-off-by: Philip Withnall
+---
+ glib/gvariant-parser.c | 58 ++++++++++++++++++++++++------------------
+ 1 file changed, 33 insertions(+), 25 deletions(-)
+
+diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
+index 560562446..ade5a9fa7 100644
+--- a/glib/gvariant-parser.c
++++ b/glib/gvariant-parser.c
+@@ -650,9 +650,9 @@ static AST *parse (TokenStream *stream,
+ GError **error);
+
+ static void
+-ast_array_append (AST ***array,
+- gint *n_items,
+- AST *ast)
++ast_array_append (AST ***array,
++ size_t *n_items,
++ AST *ast)
+ {
+ if ((*n_items & (*n_items - 1)) == 0)
+ *array = g_renew (AST *, *array, *n_items ? 2 ** n_items : 1);
+@@ -661,10 +661,10 @@ ast_array_append (AST ***array,
+ }
+
+ static void
+-ast_array_free (AST **array,
+- gint n_items)
++ast_array_free (AST **array,
++ size_t n_items)
+ {
+- gint i;
++ size_t i;
+
+ for (i = 0; i < n_items; i++)
+ ast_free (array[i]);
+@@ -673,11 +673,11 @@ ast_array_free (AST **array,
+
+ static gchar *
+ ast_array_get_pattern (AST **array,
+- gint n_items,
++ size_t n_items,
+ GError **error)
+ {
+ gchar *pattern;
+- gint i;
++ size_t i;
+
+ /* Find the pattern which applies to all children in the array, by l-folding a
+ * coalesce operation.
+@@ -709,7 +709,7 @@ ast_array_get_pattern (AST **array,
+ * pair of values.
+ */
+ {
+- int j = 0;
++ size_t j = 0;
+
+ while (TRUE)
+ {
+@@ -957,7 +957,7 @@ typedef struct
+ AST ast;
+
+ AST **children;
+- gint n_children;
++ size_t n_children;
+ } Array;
+
+ static gchar *
+@@ -990,7 +990,7 @@ array_get_value (AST *ast,
+ Array *array = (Array *) ast;
+ const GVariantType *childtype;
+ GVariantBuilder builder;
+- gint i;
++ size_t i;
+
+ if (!g_variant_type_is_array (type))
+ return ast_type_error (ast, type, error);
+@@ -1076,7 +1076,7 @@ typedef struct
+ AST ast;
+
+ AST **children;
+- gint n_children;
++ size_t n_children;
+ } Tuple;
+
+ static gchar *
+@@ -1086,7 +1086,7 @@ tuple_get_pattern (AST *ast,
+ Tuple *tuple = (Tuple *) ast;
+ gchar *result = NULL;
+ gchar **parts;
+- gint i;
++ size_t i;
+
+ parts = g_new (gchar *, tuple->n_children + 4);
+ parts[tuple->n_children + 1] = (gchar *) ")";
+@@ -1116,7 +1116,7 @@ tuple_get_value (AST *ast,
+ Tuple *tuple = (Tuple *) ast;
+ const GVariantType *childtype;
+ GVariantBuilder builder;
+- gint i;
++ size_t i;
+
+ if (!g_variant_type_is_tuple (type))
+ return ast_type_error (ast, type, error);
+@@ -1308,9 +1308,16 @@ typedef struct
+
+ AST **keys;
+ AST **values;
+- gint n_children;
++
++ /* Iff this is DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY then this struct
++ * represents a single freestanding dict entry (`{1, "one"}`) rather than a
++ * full dict. In the freestanding case, @keys and @values have exactly one
++ * member each. */
++ size_t n_children;
+ } Dictionary;
+
++#define DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY ((size_t) -1)
++
+ static gchar *
+ dictionary_get_pattern (AST *ast,
+ GError **error)
+@@ -1325,7 +1332,7 @@ dictionary_get_pattern (AST *ast,
+ return g_strdup ("Ma{**}");
+
+ key_pattern = ast_array_get_pattern (dict->keys,
+- abs (dict->n_children),
++ (dict->n_children == DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY) ? 1 : dict->n_children,
+ error);
+
+ if (key_pattern == NULL)
+@@ -1356,7 +1363,7 @@ dictionary_get_pattern (AST *ast,
+ return NULL;
+
+ result = g_strdup_printf ("M%s{%c%s}",
+- dict->n_children > 0 ? "a" : "",
++ (dict->n_children > 0 && dict->n_children != DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY) ? "a" : "",
+ key_char, value_pattern);
+ g_free (value_pattern);
+
+@@ -1370,7 +1377,7 @@ dictionary_get_value (AST *ast,
+ {
+ Dictionary *dict = (Dictionary *) ast;
+
+- if (dict->n_children == -1)
++ if (dict->n_children == DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY)
+ {
+ const GVariantType *subtype;
+ GVariantBuilder builder;
+@@ -1403,7 +1410,7 @@ dictionary_get_value (AST *ast,
+ {
+ const GVariantType *entry, *key, *val;
+ GVariantBuilder builder;
+- gint i;
++ size_t i;
+
+ if (!g_variant_type_is_subtype_of (type, G_VARIANT_TYPE_DICTIONARY))
+ return ast_type_error (ast, type, error);
+@@ -1444,12 +1451,12 @@ static void
+ dictionary_free (AST *ast)
+ {
+ Dictionary *dict = (Dictionary *) ast;
+- gint n_children;
++ size_t n_children;
+
+- if (dict->n_children > -1)
+- n_children = dict->n_children;
+- else
++ if (dict->n_children == DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY)
+ n_children = 1;
++ else
++ n_children = dict->n_children;
+
+ ast_array_free (dict->keys, n_children);
+ ast_array_free (dict->values, n_children);
+@@ -1467,7 +1474,7 @@ dictionary_parse (TokenStream *stream,
+ maybe_wrapper, dictionary_get_value,
+ dictionary_free
+ };
+- gint n_keys, n_values;
++ size_t n_keys, n_values;
+ gboolean only_one;
+ Dictionary *dict;
+ AST *first;
+@@ -1510,7 +1517,7 @@ dictionary_parse (TokenStream *stream,
+ goto error;
+
+ g_assert (n_keys == 1 && n_values == 1);
+- dict->n_children = -1;
++ dict->n_children = DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY;
+
+ return (AST *) dict;
+ }
+@@ -1543,6 +1550,7 @@ dictionary_parse (TokenStream *stream,
+ }
+
+ g_assert (n_keys == n_values);
++ g_assert (n_keys != DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY);
+ dict->n_children = n_keys;
+
+ return (AST *) dict;
+--
+2.53.0
+
+
+From b73a8d655d4f50450483a9948ab59edcd71780fa Mon Sep 17 00:00:00 2001
+From: Philip Withnall
+Date: Tue, 25 Nov 2025 19:25:58 +0000
+Subject: [PATCH 4/4] gvariant-parser: Convert error handling code to use
+ size_t
+
+The error handling code allows for printing out the range of input bytes
+related to a parsing error. This was previously done using `gint`, but
+the input could be longer than `INT_MAX`, so it should really be done
+using `size_t`.
+
+Spotted while working on #3834.
+
+Signed-off-by: Philip Withnall
+---
+ glib/gvariant-parser.c | 36 +++++++++++++++++++++++-------------
+ 1 file changed, 23 insertions(+), 13 deletions(-)
+
+diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
+index ade5a9fa7..0ddb4794e 100644
+--- a/glib/gvariant-parser.c
++++ b/glib/gvariant-parser.c
+@@ -91,7 +91,9 @@ g_variant_parser_get_error_quark (void)
+
+ typedef struct
+ {
+- gint start, end;
++ /* Offsets from the start of the input, in bytes. Can be equal when referring
++ * to a point rather than a range. The invariant `end >= start` always holds. */
++ size_t start, end;
+ } SourceRef;
+
+ G_GNUC_PRINTF(5, 0)
+@@ -106,14 +108,16 @@ parser_set_error_va (GError **error,
+ GString *msg = g_string_new (NULL);
+
+ if (location->start == location->end)
+- g_string_append_printf (msg, "%d", location->start);
++ g_string_append_printf (msg, "%" G_GSIZE_FORMAT, location->start);
+ else
+- g_string_append_printf (msg, "%d-%d", location->start, location->end);
++ g_string_append_printf (msg, "%" G_GSIZE_FORMAT "-%" G_GSIZE_FORMAT,
++ location->start, location->end);
+
+ if (other != NULL)
+ {
+ g_assert (other->start != other->end);
+- g_string_append_printf (msg, ",%d-%d", other->start, other->end);
++ g_string_append_printf (msg, ",%" G_GSIZE_FORMAT "-%" G_GSIZE_FORMAT,
++ other->start, other->end);
+ }
+ g_string_append_c (msg, ':');
+
+@@ -140,11 +144,15 @@ parser_set_error (GError **error,
+
+ typedef struct
+ {
++ /* We should always have the following ordering constraint:
++ * start <= this <= stream <= end
++ * Additionally, unless in an error or EOF state, `this < stream`.
++ */
+ const gchar *start;
+ const gchar *stream;
+ const gchar *end;
+
+- const gchar *this;
++ const gchar *this; /* (nullable) */
+ } TokenStream;
+
+
+@@ -175,7 +183,7 @@ token_stream_set_error (TokenStream *stream,
+ static gboolean
+ token_stream_prepare (TokenStream *stream)
+ {
+- gint brackets = 0;
++ gssize brackets = 0;
+ const gchar *end;
+
+ if (stream->this != NULL)
+@@ -405,7 +413,7 @@ static void
+ pattern_copy (gchar **out,
+ const gchar **in)
+ {
+- gint brackets = 0;
++ gssize brackets = 0;
+
+ while (**in == 'a' || **in == 'm' || **in == 'M')
+ *(*out)++ = *(*in)++;
+@@ -2743,7 +2751,7 @@ g_variant_builder_add_parsed (GVariantBuilder *builder,
+ static gboolean
+ parse_num (const gchar *num,
+ const gchar *limit,
+- guint *result)
++ size_t *result)
+ {
+ gchar *endptr;
+ gint64 bignum;
+@@ -2753,10 +2761,12 @@ parse_num (const gchar *num,
+ if (endptr != limit)
+ return FALSE;
+
++ /* The upper bound here is more restrictive than it technically needs to be,
++ * but should be enough for any practical situation: */
+ if (bignum < 0 || bignum > G_MAXINT)
+ return FALSE;
+
+- *result = (guint) bignum;
++ *result = (size_t) bignum;
+
+ return TRUE;
+ }
+@@ -2767,7 +2777,7 @@ add_last_line (GString *err,
+ {
+ const gchar *last_nl;
+ gchar *chomped;
+- gint i;
++ size_t i;
+
+ /* This is an error at the end of input. If we have a file
+ * with newlines, that's probably the empty string after the
+@@ -2912,7 +2922,7 @@ g_variant_parse_error_print_context (GError *error,
+
+ if (dash == NULL || colon < dash)
+ {
+- guint point;
++ size_t point;
+
+ /* we have a single point */
+ if (!parse_num (error->message, colon, &point))
+@@ -2930,7 +2940,7 @@ g_variant_parse_error_print_context (GError *error,
+ /* We have one or two ranges... */
+ if (comma && comma < colon)
+ {
+- guint start1, end1, start2, end2;
++ size_t start1, end1, start2, end2;
+ const gchar *dash2;
+
+ /* Two ranges */
+@@ -2946,7 +2956,7 @@ g_variant_parse_error_print_context (GError *error,
+ }
+ else
+ {
+- guint start, end;
++ size_t start, end;
+
+ /* One range */
+ if (!parse_num (error->message, dash, &start) || !parse_num (dash + 1, colon, &end))
+--
+2.53.0
+
diff --git a/SOURCES/CVE-2025-14512.patch b/SOURCES/CVE-2025-14512.patch
new file mode 100644
index 0000000..bc9fbf3
--- /dev/null
+++ b/SOURCES/CVE-2025-14512.patch
@@ -0,0 +1,69 @@
+From bf42b30a1fe916bbc8c29014525e890801019e93 Mon Sep 17 00:00:00 2001
+From: Philip Withnall
+Date: Thu, 4 Dec 2025 16:37:19 +0000
+Subject: [PATCH] gfileattribute: Fix integer overflow calculating escaping for
+ byte strings
+
+The number of invalid characters in the byte string (characters which
+would have to be percent-encoded) was only stored in an `int`, which
+gave the possibility of a long string largely full of invalid
+characters overflowing this and allowing an attacker-controlled buffer
+size to be allocated.
+
+This could be triggered by an attacker controlled file attribute (of
+type `G_FILE_ATTRIBUTE_TYPE_BYTE_STRING`), such as
+`G_FILE_ATTRIBUTE_THUMBNAIL_PATH` or `G_FILE_ATTRIBUTE_STANDARD_NAME`,
+being read by user code.
+
+Spotted by Codean Labs.
+
+Signed-off-by: Philip Withnall
+
+Fixes: #3845
+---
+ gio/gfileattribute.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/gio/gfileattribute.c b/gio/gfileattribute.c
+index c6fde60fa..d3083e5bd 100644
+--- a/gio/gfileattribute.c
++++ b/gio/gfileattribute.c
+@@ -22,6 +22,7 @@
+
+ #include "config.h"
+
++#include
+ #include
+
+ #include "gfileattribute.h"
+@@ -166,11 +167,12 @@ valid_char (char c)
+ return c >= 32 && c <= 126 && c != '\\';
+ }
+
++/* Returns NULL on error */
+ static char *
+ escape_byte_string (const char *str)
+ {
+ size_t i, len;
+- int num_invalid;
++ size_t num_invalid;
+ char *escaped_val, *p;
+ unsigned char c;
+ const char hex_digits[] = "0123456789abcdef";
+@@ -188,7 +190,12 @@ escape_byte_string (const char *str)
+ return g_strdup (str);
+ else
+ {
+- escaped_val = g_malloc (len + num_invalid*3 + 1);
++ /* Check for overflow. We want to check the inequality:
++ * !(len + num_invalid * 3 + 1 > SIZE_MAX) */
++ if (num_invalid >= (SIZE_MAX - len) / 3)
++ return NULL;
++
++ escaped_val = g_malloc (len + num_invalid * 3 + 1);
+
+ p = escaped_val;
+ for (i = 0; i < len; i++)
+--
+2.53.0
+
diff --git a/SOURCES/gnutls-hmac.patch b/SOURCES/gnutls-hmac.patch
index 4b1ba0e..d773dbd 100644
--- a/SOURCES/gnutls-hmac.patch
+++ b/SOURCES/gnutls-hmac.patch
@@ -1,4 +1,4 @@
-From ff90bb8474b1e724727f4014b446e7c851e609bd Mon Sep 17 00:00:00 2001
+From 4f8c85db9f6461ae44168863186fccb7e94e3542 Mon Sep 17 00:00:00 2001
From: Colin Walters
Date: Fri, 7 Jun 2019 18:44:43 +0000
Subject: [PATCH 1/4] ghmac: Split off wrapper functions into ghmac-utils.c
@@ -296,9 +296,10 @@ index 8c18e6de4..329b8d197 100644
'ghostutils.c',
'giochannel.c',
--
-2.31.1
+2.52.0
-From 5395d36e6685e0b7377794c59c5820970bb472ef Mon Sep 17 00:00:00 2001
+
+From 0de9f7dcf76bf75813b8aad134b2827620067a89 Mon Sep 17 00:00:00 2001
From: Colin Walters
Date: Fri, 7 Jun 2019 19:36:54 +0000
Subject: [PATCH 2/4] Add a gnutls backend for GHmac
@@ -348,17 +349,30 @@ don't think this error should actually be hit in practice.
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/903
---
- glib/gchecksum.c | 9 +-
- glib/gchecksumprivate.h | 32 +++++++
- glib/ghmac-gnutls.c | 187 ++++++++++++++++++++++++++++++++++++++++
- glib/ghmac.c | 15 ++++
- glib/meson.build | 10 ++-
- meson.build | 7 ++
- meson_options.txt | 7 +-
- 7 files changed, 260 insertions(+), 7 deletions(-)
+ docs/reference/glib/meson.build | 1 +
+ glib/gchecksum.c | 9 +-
+ glib/gchecksumprivate.h | 32 ++++++
+ glib/ghmac-gnutls.c | 187 ++++++++++++++++++++++++++++++++
+ glib/ghmac.c | 15 +++
+ glib/meson.build | 10 +-
+ meson.build | 7 ++
+ meson_options.txt | 5 +
+ 8 files changed, 260 insertions(+), 6 deletions(-)
create mode 100644 glib/gchecksumprivate.h
create mode 100644 glib/ghmac-gnutls.c
+diff --git a/docs/reference/glib/meson.build b/docs/reference/glib/meson.build
+index 43c273855..69fa14051 100644
+--- a/docs/reference/glib/meson.build
++++ b/docs/reference/glib/meson.build
+@@ -40,6 +40,7 @@ if get_option('gtk_doc')
+ 'gutilsprivate.h',
+ 'gvalgrind.h',
+ 'dirent.h',
++ 'gchecksumprivate.h'
+ ]
+
+ docpath = join_paths(glib_datadir, 'gtk-doc', 'html')
diff --git a/glib/gchecksum.c b/glib/gchecksum.c
index 29b479bc6..929958c3a 100644
--- a/glib/gchecksum.c
@@ -701,7 +715,7 @@ index 329b8d197..2417de53d 100644
objc_args : glib_c_args,
)
diff --git a/meson.build b/meson.build
-index e2eba1871..cca15f653 100644
+index a0223ce5b..5dfd587eb 100644
--- a/meson.build
+++ b/meson.build
@@ -2090,6 +2090,13 @@ if host_system == 'linux'
@@ -719,7 +733,7 @@ index e2eba1871..cca15f653 100644
winsock2 = cc.find_library('ws2_32')
endif
diff --git a/meson_options.txt b/meson_options.txt
-index 072765361..c8f26ac02 100644
+index 072765361..0a672fd30 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -39,6 +39,11 @@ option('internal_pcre',
@@ -735,9 +749,10 @@ index 072765361..c8f26ac02 100644
type : 'boolean',
value : false,
--
-2.31.1
+2.52.0
-From 61c175277acb8d1e080305acd444201c5ad1fb81 Mon Sep 17 00:00:00 2001
+
+From 2cc560c8461068dee4ea01a19fcb608c0fd0bf1f Mon Sep 17 00:00:00 2001
From: Michael Catanzaro
Date: Wed, 16 Jun 2021 20:35:00 -0500
Subject: [PATCH 3/4] dlopen GnuTLS instead of linking directly
@@ -932,7 +947,7 @@ index 2417de53d..ba42951aa 100644
objc_args : glib_c_args,
)
diff --git a/meson.build b/meson.build
-index cca15f653..404ef1790 100644
+index 5dfd587eb..a743f73a3 100644
--- a/meson.build
+++ b/meson.build
@@ -2090,11 +2090,9 @@ if host_system == 'linux'
@@ -950,9 +965,10 @@ index cca15f653..404ef1790 100644
if host_system == 'windows'
--
-2.31.1
+2.52.0
-From 7d1d96311b6ecd4f90ebbdd6fc58d28e06a86887 Mon Sep 17 00:00:00 2001
+
+From 8469fa31b16011d1decc75a1fef185c06e39fd5a Mon Sep 17 00:00:00 2001
From: Michael Catanzaro
Date: Wed, 16 Jun 2021 20:46:24 -0500
Subject: [PATCH 4/4] Add test for GHmac in FIPS mode
@@ -1083,4 +1099,5 @@ index 3ac3206df..2fa447984 100644
return g_test_run ();
}
--
-2.31.1
+2.52.0
+
diff --git a/SPECS/glib2.spec b/SPECS/glib2.spec
index befdfd5..80c959a 100644
--- a/SPECS/glib2.spec
+++ b/SPECS/glib2.spec
@@ -1,6 +1,6 @@
Name: glib2
Version: 2.68.4
-Release: 19%{?dist}
+Release: 21%{?dist}
Summary: A library of handy utility functions
License: LGPLv2+
@@ -85,6 +85,16 @@ Patch: CVE-2025-13601.patch
# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4931
Patch: gunixmount-improvements.patch
+# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4933
+# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4921
+Patch: CVE-2025-14087.patch
+
+# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4935
+Patch: CVE-2025-14512.patch
+
+# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5247
+Patch: 5247.patch
+
BuildRequires: chrpath
BuildRequires: gcc
BuildRequires: gcc-c++
@@ -106,9 +116,15 @@ BuildRequires: pkgconfig(sysprof-capture-4)
BuildRequires: pkgconfig(zlib)
BuildRequires: python3-devel
+# Dependencies for tests
+BuildRequires: shared-mime-info
+BuildRequires: /usr/bin/dbus-daemon
+BuildRequires: /usr/bin/update-desktop-database
+
# For gnutls-hmac.patch. We now dlopen libgnutls.so.30 so that we can build a
# static glib2 without depending on a static build of GnuTLS as well. This will
# ensure we notice if the GnuTLS soname bumps, so that we can update our patch.
+BuildRequires: gnutls
%if 0%{?__isa_bits} == 64
Requires: libgnutls.so.30()(64bit)
%else
@@ -300,6 +316,14 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
%{_datadir}/installed-tests
%changelog
+* Mon Jul 14 2026 Joan Torres Lopez - 2.68.4-21
+- gdbusnameowning: Downgrade ReleaseName warning on closed connection to debug
+ Resolves: RHEL-14597
+
+* Fri Apr 24 2026 Michael Catanzaro - 2.68.4-20
+- Add patch for CVE-2025-14087 and CVE-2025-14512
+- Run testsuite during RPM check phase
+
* Mon Jan 19 2026 Michael Catanzaro - 2.68.4-19
- Add patch for CVE-2025-13601
- Fix GUnixMount issues