Backport upstream fix for CVE-2026-58013, which addresses a
buffer over-read in GIOChannel when using multi-byte line
terminators. The memcmp() call could read past the end of
the internal GString buffer when the line extends to the
buffer boundary. The patch adds a length check before the
memcmp() and includes a new unit test. The test was adapted
for GLib 2.68 by replacing unavailable C99/GLib 2.70
constructs (uint8_t, g_steal_fd) with their GLib 2.68
equivalents.
CVE: CVE-2026-58013
Upstream patches:
- 9f557746c5.patch
Resolves: RHEL-212237
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit aa1cb87d56111ef989811e824f0ac77484cc997f
to fix CVE-2026-58010, an off-by-one error in
gvs_tuple_is_normal() in glib/gvariant-serialiser.c.
The bug allowed a single byte out-of-bounds read off the end
of a GVariant's backing byte array during normal form checking.
The fix changes `>` to `>=` in an offset bounds check, and a
regression test is included.
CVE: CVE-2026-58010
Upstream patches:
- aa1cb87d56.patch
Resolves: RHEL-212171
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add backport patch for CVE-2026-58012 which fixes case changing
substitutions when using G_REGEX_RAW mode. Without this fix,
g_regex_replace() could perform out-of-bounds reads when
processing non-UTF-8 matched data with case change escape
sequences (e.g. \U\0) because it incorrectly assumed UTF-8
encoding. The fix adds raw-mode-aware case conversion that uses
ASCII operations instead of UTF-8 character functions.
CVE: CVE-2026-58012
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5132.patch
Resolves: RHEL-212218
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix (commit c9da977c) for CVE-2026-58016,
which corrects the XML parser state handling for `<node>` element
nesting in gdbusintrospection. The broken condition in
parser_start_element() failed to properly validate that `<node>`
elements can only appear at the top level or nested immediately
within another `<node>` element. The patch also adds unit tests
for invalid XML nesting scenarios.
CVE: CVE-2026-58016
Upstream patches:
- c9da977c17.patch
Resolves: RHEL-190627
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport a patch from upstream to prevent GDBusConnection from sending
a message with a serial of zero when the serial counter overflows.
This is not allowed by the D-Bus specification.
Upstream fix: b94b44407a.patch
Resolves: RHEL-114059
This commit was backported by Jotnar, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Jotnar
This doesn't seem to be as important for Eclipse as originally expected,
but let's land it anyway. It notably fixes a couple nasty regressions
from RHEL 8, including one that could cause applications to hang when
launching a subprocess if they attempt to use the fd remapping
functionality.
Resolves: #1910092
The mem-overflow test depends on -O1. This is less-secure, but that's OK
because it's just a test.
I'm not sure exactly what is wrong with the second test: various
security checks are failing, likely related to the strange way this test
binary is constructed via objcopy. My main concern was to ensure that
nothing is generally wrong with GResource, but that seems to be OK.
Since the issues are isolated to this test, and it's just a test, I
think we can safely ignore them.
