rpms/glib2
7
0
Fork 0
Code Issues Pull Requests Releases Activity
A library of handy utility functions
72 Commits 9 Branches 84 Tags 1.8 MiB
Diff 100%
c9s
Go to file
RHEL Packaging Agent 138500dd5a Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list 
Backport upstream commit 5f6d86b50bebf5458ab1becf4de2c5e5f066122b
to fix CVE-2026-58014, a one-byte heap under-read in
g_key_file_get_locale_string_list() when called on a key with
an empty value. The fix adds a `len > 0` guard before accessing
value[len-1]. The patch also includes a unit test and fuzzing
test enhancement.

CVE: CVE-2026-58014
Upstream patches:
 - 5f6d86b50b.patch
Resolves: RHEL-190604

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-19 16:32:47 +00:00
.fmf metadata preparation for RHIVOS 2024-10-30 16:55:05 +00:00
.gitignore RHEL 9.0.0 Alpha bootstrap 2020-10-15 01:44:22 +02:00
1965.patch Backport GPowerProfileMonitor 2021-08-17 15:56:56 -05:00
1968.patch WebKitGTK should use posix_spawn() to launch subprocesses 2022-01-21 10:44:05 -06:00
2194.patch Backport GPowerProfileMonitor 2021-08-17 15:56:56 -05:00
2222.patch Backport GPowerProfileMonitor 2021-08-17 15:56:56 -05:00
2244.patch Fix g_get_user_database_entry() crash when used with nss-systemd 2021-09-15 15:20:23 -05:00
2291.patch Fix GNetworkMonitor after NetworkManager D-Bus API changes 2021-12-01 13:18:50 -06:00
2408.patch Fix race with waitpid() and child watcher sources 2023-11-03 13:56:34 -05:00
2435.patch Add one more upstream patch to gspawn patchset 2022-01-27 10:33:58 -06:00
2826.patch Really fix authentication failures when sd-bus clients connect to GDBus servers 2023-07-19 10:13:07 -05:00
3126.patch Run testsuite during check phase 2026-05-07 14:26:12 -05:00
3136.patch Resolve s390x crashes introduced by fixes for CVE-2023-24593/CVE-2023-25180 2023-05-25 14:35:00 -05:00
3163.patch Resolve use after free introduced by fixes for CVE-2023-24593/CVE-2023-25180 2023-05-17 16:13:58 -05:00
3272.patch Fix authentication failures when sd-bus clients connect to GDBus servers 2023-07-06 13:17:52 -05:00
3353.patch Fix race with waitpid() and child watcher sources 2023-11-03 13:56:34 -05:00
3845.patch Backport GUnixMountMonitor port to libmnt_monitor 2024-02-02 09:49:46 -06:00
4038.patch Fix CVE-2024-34397, signal subscription vulnerabilities 2024-05-13 15:04:11 -05:00
4155.patch Add support for x-gvfs-trash mount option 2024-09-26 10:22:57 +02:00
5247.patch gdbusnameowning: Downgrade ReleaseName warning on closed connection to debug 2026-07-14 16:41:43 +02:00
CVE-2024-52533.patch Add patches for CVE-2024-52533 and CVE-2025-4373 2025-07-11 10:25:48 -05:00
CVE-2025-4373.patch Add patches for CVE-2024-52533 and CVE-2025-4373 2025-07-11 10:25:48 -05:00
CVE-2025-13601.patch Add patch for CVE-2025-13601 and patches for GUnixMount issues 2026-01-19 17:54:20 -06:00
CVE-2025-14087.patch Fix CVE-2025-14087 and CVE-2025-14512 2026-05-07 14:25:20 -05:00
CVE-2025-14512.patch Fix CVE-2025-14087 and CVE-2025-14512 2026-05-07 14:25:20 -05:00
CVE-2026-15588.patch Fix CVE-2026-15588: limit D-Bus auth line read length 2026-08-19 16:29:30 +00:00
CVE-2026-58010.patch Fix CVE-2026-58010: off-by-one error in GVariant tuple normal form checking 2026-08-19 16:26:07 +00:00
CVE-2026-58011.patch Fix CVE-2026-58011: range validation in g_date_time_add_full() 2026-08-19 16:26:07 +00:00
CVE-2026-58012.patch Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW 2026-08-19 16:26:07 +00:00
CVE-2026-58013.patch Fix CVE-2026-58013: buffer over-read in GIOChannel with long terminators 2026-08-19 16:26:07 +00:00
CVE-2026-58014.patch Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list 2026-08-19 16:32:47 +00:00
CVE-2026-58015.patch Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context 2026-08-19 16:31:12 +00:00
CVE-2026-58016.patch Fix CVE-2026-58016: XML parser state handling for node nesting 2026-07-24 14:29:25 +00:00
gating.yaml enabling gating for el9 2021-06-16 13:20:59 +02:00
gdatetime-test.patch Add patches for CVE-2024-52533 and CVE-2025-4373 2025-07-11 10:25:48 -05:00
gdbusconnection-serial-number-overflow.patch Add patch for CVE-2025-13601 and patches for GUnixMount issues 2026-01-19 17:54:20 -06:00
glib2.spec Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list 2026-08-19 16:32:47 +00:00
gnutls-hmac.patch Run testsuite during check phase 2026-05-07 14:26:12 -05:00
gunixmount-improvements.patch Add patch for CVE-2025-13601 and patches for GUnixMount issues 2026-01-19 17:54:20 -06:00
main.fmf Update main.fmf 2024-12-06 09:20:46 +00:00
rpminspect.yaml Update annocheck policy 2021-12-06 13:38:54 -06:00
sources Update to 2.68.4 2021-08-24 13:43:35 +02:00