Backport upstream commit 8b72ad09c874ddff to fix
CVE-2026-58015, a path traversal vulnerability in D-Bus
SHA-1 authentication. The patch adds validation of the
cookie context sent by the server, preventing exfiltration
of SHA-1 hashed copies of arbitrary files from the client's
filesystem. The upstream patch was adjusted to use guint8
instead of uint8_t for compatibility with the existing
GLib headers.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212242
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 49e067570dfa from GNOME/glib MR !5132
to fix CVE-2026-58012, a buffer overflow in gregex.c when
performing case-changing substitutions (\U, \u, \L, \l) with
G_REGEX_RAW mode. The fix uses g_ascii_tolower/toupper instead
of g_unichar_tolower/toupper in raw (non-UTF-8) mode, preventing
out-of-bounds reads on truncated multi-byte sequences.
Resolves: RHEL-212206
CVE: CVE-2026-58012
Upstream patches:
- 49e067570d.patch
Resolves: RHEL-212206
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch for CVE-2026-58010 which fixes an off-by-one error
in the GVariant tuple serialiser's normal form checking code.
The bug allowed a single byte out-of-bounds read when verifying
padding bytes in a short (non-normal) tuple. The patch changes
the offset comparison from `>` to `>=` in
gvs_tuple_is_normal() and adds a regression test. An additional
fix includes `<stdint.h>` in the test file so that the new test
using `uint8_t` compiles correctly against the older glib 2.80.4
codebase.
CVE: CVE-2026-58010
Upstream patches:
- 8338414f65.patch
Resolves: RHEL-212160
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58011 from MR !5131.
The patch includes two cherry-picked commits: a preparatory
refactoring introducing MIN_DAYS/MAX_DAYS constants, and the
actual fix adding bounds validation to g_date_time_add_full()
to prevent creation of invalid GDateTime objects. Test cases
for out-of-range inputs are also included.
CVE: CVE-2026-58011
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5131.patch
Resolves: RHEL-212183
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 407349aa255a5c2b49caa52847aca1b8311c98b2
("gdbusauth: Limit length of lines read from client") to fix
CVE-2026-15588. The patch adds a maximum line length limit to
GDBusAuth server-side reads during authentication, preventing
untrusted clients from exhausting server memory by sending
arbitrarily long lines. A unit test for the new limit is
included.
CVE: CVE-2026-15588
Upstream patches:
- 407349aa25.patch
Resolves: RHEL-219130
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 5f6d86b50bebf5458ab1becf4de2c5e5f066122b
to fix CVE-2026-58014, a one-byte heap under-read in
g_key_file_get_locale_string_list() when called on a key
with an empty value. The fix adds a `len > 0` guard check
before accessing the buffer. The patch also includes
fuzzing and unit test improvements.
CVE: CVE-2026-58014
Upstream patches:
- 5f6d86b50b.patch
Resolves: RHEL-190597
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58013 from MR !5170. The fix
prevents a memcmp() from reading past the end of the GString
buffer when using a multi-byte line terminator in GIOChannel.
The patch also includes a unit test for the fix. An additional
#include <stdint.h> was added to the test file to ensure
compatibility with glib 2.80.4 headers.
CVE: CVE-2026-58013
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5170.patch
Resolves: RHEL-212239
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-58016 from upstream commit
c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 (MR !5156).
The fix corrects broken XML parser state handling for
<node> element nesting in gio/gdbusintrospection.c, and
adds unit tests for invalid introspection XML parsing.
CVE: CVE-2026-58016
Upstream patches:
- c9da977c17.patch
Resolves: RHEL-190613
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
A patch has been backported to fix an issue where GDBusConnection could send a
message with an invalid serial of zero after the serial counter overflowed.
This could happen in very long-running processes that use a single
GDBusConnection to send a large number of messages.
Upstream fix: b94b44407a.patch
Resolves: RHEL-114857
This commit was backported by Jotnar, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Jotnar
This is a part of approved Fedora change:
https://fedoraproject.org/wiki/Changes/Separate_dtrace_package
systemtap-sdt-devel will stop requiring systemtap-sdt-dtrace
and that would break the build of this package.
(cherry picked from commit 42c424fc227ddd3a74d8b80617164f0883a2c62e)
Also, rename an old patch because I've soured on my own strategy for
naming patches after merge request IDs, which doesn't tell you what the
patch actually does.
Resolves: RHEL-84440
FIPS mode is currently broken in both Fedora rawhide and RHEL 10. This
test is no longer useful because it's now testing whether GnuTLS works
rather than whether GLib works.
Related: RHEL-44610
They pass at build time, but fail during gating, presumably because
crypto policy is different and blocks SHA-1. Let's just not run these
tests, same as we already do for MD-5. There is plenty of test coverage
for the other HMAC algorithms.
Related: RHEL-44610
Not doing this in RHEL.
This is likely going to break if the container system's runc is
outdated. Consider updating the container host.
Related: RHEL-30209
- Rebase gnutls-hmac.patch
- Add gir and typelib files that moved here from gobject-introspection
- Explicitly conflict with older gobject-introspection
- Switch to building docs with gi-docgen instead of gtk-doc
