Backport upstream commit 5f6d86b50bebf5458ab1becf4de2c5e5f066122b
to fix CVE-2026-58014, a one-byte heap under-read in
g_key_file_get_locale_string_list() when called on a key with
an empty value. The fix adds a `len > 0` guard before accessing
value[len-1]. The patch also includes a unit test and fuzzing
test enhancement.
CVE: CVE-2026-58014
Upstream patches:
- 5f6d86b50b.patch
Resolves: RHEL-190604
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add patch for CVE-2026-58015 which validates the cookie context
in the GDBus SHA-1 authentication mechanism. Without validation,
a malicious D-Bus server could send a crafted context containing
path traversal characters, allowing exfiltration of SHA-1 hashed
copies of arbitrary data from the client's file system. The patch
also includes an added `#include <stdint.h>` needed for the
`uint8_t` type used in the validation function on the older
glib2 2.68.4 codebase.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212262
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix from GNOME/glib MR !5240 (commit 407349aa)
for CVE-2026-15588. The patch adds a line length limit in
GDBusAuth to prevent an untrusted D-Bus client from exhausting
server memory by sending arbitrarily long authentication lines.
A corresponding unit test is included.
CVE: CVE-2026-15588
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5240.patch
Resolves: RHEL-219128
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix from GNOME/glib MR #5131 for
CVE-2026-58011. The patch adds missing range validation to
g_date_time_add_full() to prevent creation of invalid
GDateTime objects outside the 0001-01-01 to 9999-12-31
range. Also refactors magic day-count constants into named
defines for clarity.
CVE: CVE-2026-58011
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5131.patch
Resolves: RHEL-212196
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58013, which addresses a
buffer over-read in GIOChannel when using multi-byte line
terminators. The memcmp() call could read past the end of
the internal GString buffer when the line extends to the
buffer boundary. The patch adds a length check before the
memcmp() and includes a new unit test. The test was adapted
for GLib 2.68 by replacing unavailable C99/GLib 2.70
constructs (uint8_t, g_steal_fd) with their GLib 2.68
equivalents.
CVE: CVE-2026-58013
Upstream patches:
- 9f557746c5.patch
Resolves: RHEL-212237
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit aa1cb87d56111ef989811e824f0ac77484cc997f
to fix CVE-2026-58010, an off-by-one error in
gvs_tuple_is_normal() in glib/gvariant-serialiser.c.
The bug allowed a single byte out-of-bounds read off the end
of a GVariant's backing byte array during normal form checking.
The fix changes `>` to `>=` in an offset bounds check, and a
regression test is included.
CVE: CVE-2026-58010
Upstream patches:
- aa1cb87d56.patch
Resolves: RHEL-212171
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add backport patch for CVE-2026-58012 which fixes case changing
substitutions when using G_REGEX_RAW mode. Without this fix,
g_regex_replace() could perform out-of-bounds reads when
processing non-UTF-8 matched data with case change escape
sequences (e.g. \U\0) because it incorrectly assumed UTF-8
encoding. The fix adds raw-mode-aware case conversion that uses
ASCII operations instead of UTF-8 character functions.
CVE: CVE-2026-58012
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5132.patch
Resolves: RHEL-212218
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix (commit c9da977c) for CVE-2026-58016,
which corrects the XML parser state handling for `<node>` element
nesting in gdbusintrospection. The broken condition in
parser_start_element() failed to properly validate that `<node>`
elements can only appear at the top level or nested immediately
within another `<node>` element. The patch also adds unit tests
for invalid XML nesting scenarios.
CVE: CVE-2026-58016
Upstream patches:
- c9da977c17.patch
Resolves: RHEL-190627
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport a patch from upstream to prevent GDBusConnection from sending
a message with a serial of zero when the serial counter overflows.
This is not allowed by the D-Bus specification.
Upstream fix: b94b44407a.patch
Resolves: RHEL-114059
This commit was backported by Jotnar, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Jotnar
This doesn't seem to be as important for Eclipse as originally expected,
but let's land it anyway. It notably fixes a couple nasty regressions
from RHEL 8, including one that could cause applications to hang when
launching a subprocess if they attempt to use the fd remapping
functionality.
Resolves: #1910092
The mem-overflow test depends on -O1. This is less-secure, but that's OK
because it's just a test.
I'm not sure exactly what is wrong with the second test: various
security checks are failing, likely related to the strange way this test
binary is constructed via objcopy. My main concern was to ensure that
nothing is generally wrong with GResource, but that seems to be OK.
Since the issues are isolated to this test, and it's just a test, I
think we can safely ignore them.
