Backport upstream fix for CVE-2026-58011 from GNOME/glib MR !5131
to glib2 2.56.4. The patch adds range validation in
g_date_time_add_full() to prevent creation of invalid GDateTime
objects with out-of-range day values, returning NULL instead.
Includes five test cases verifying the fix.
CVE: CVE-2026-58011
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5131.patch
Resolves: RHEL-212187
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit 49e067570dfa to fix CVE-2026-58012,
a buffer overflow in GRegex's string_append() when using
G_REGEX_RAW mode with case-changing substitutions on truncated
multi-byte UTF-8 sequences. The patch was adapted for glib
2.56.4 compatibility.
CVE: CVE-2026-58012
Upstream patches:
- 49e067570d.patch
Resolves: RHEL-212204
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-58013 to glib2-2.56.4. The patch
fixes a buffer over-read in giochannel.c where memcmp()
could read past the end of the buffer when a multi-byte
line terminator is used and the line extends to the end of
the buffer. A bounds check is added before the memcmp()
call. A minimal test file (io-channel.c) is included,
adapted for 2.56.4 API compatibility.
CVE: CVE-2026-58013
Upstream patches:
- 9f557746c5.patch
Resolves: RHEL-212229
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Add a backport of upstream commit 8b72ad09 which fixes
CVE-2026-58015 by validating D-Bus cookie context names
in gdbusauthmechanismsha1. The new validate_cookie_context()
function rejects contexts containing non-ASCII characters or
path traversal characters (/, \, .) before they can be used
for file path construction.
The patch was adapted for the older GLib 2.56.4 codebase:
uint8_t cast replaced with guint8, and reject_reason usage
replaced with g_warning() to avoid pulling in a separate
upstream prerequisite commit.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212254
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58014 from GNOME/glib MR !5171.
The patch adds a `len > 0` guard before accessing `value[len - 1]`
in g_key_file_get_locale_string_list() to prevent a one-byte heap
under-read when the key value is empty. Includes a unit test for
the fix.
CVE: CVE-2026-58014
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171.patch
Resolves: RHEL-190587
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream commit c9da977c178 to fix CVE-2026-58016 in
glib2. The fix corrects a broken logical condition in the D-Bus
introspection XML parser (gio/gdbusintrospection.c) that failed
to properly validate `<node>` element nesting. The original
negated tautological OR expression always evaluated to false;
the fix replaces it with the correct check. Includes new unit
tests for invalid XML parsing.
CVE: CVE-2026-58016
Upstream patches:
- c9da977c17.patch
Resolves: RHEL-190622
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport a patch that prevents sending an invalid D-Bus message with a serial of zero when the message serial counter overflows. Instead of wrapping to 0, the serial now wraps to 1, avoiding the issue.
Upstream fix: b94b44407a.patch
Resolves: RHEL-114086
This commit was backported by Jotnar, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Jotnar
