diff --git a/SOURCES/CVE-2026-41991.patch b/SOURCES/CVE-2026-41991.patch new file mode 100644 index 0000000..cfa752c --- /dev/null +++ b/SOURCES/CVE-2026-41991.patch @@ -0,0 +1,54 @@ +From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 16 Apr 2026 12:11:44 -0700 +Subject: gzexe: use -C if lacking mktemp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +(Problem reported by Michał Majchrowicz.) +* gzexe.in: If mktemp is needed but not installed, +use ‘set -C’ to avoid a race when creating a temporary file. +* zdiff.in: Use the same pattern here, even though the old +code was probably OK anyway. +--- + NEWS | 5 +++++ + gzexe.in | 1 + + zdiff.in | 7 +++---- + 3 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/gzexe.in b/gzexe.in +index ea4ef94..f3d46cc 100644 +--- a/gzexe.in ++++ b/gzexe.in +@@ -127,6 +127,7 @@ for i do + tmp=`mktemp "${dir}gzexeXXXXXXXXX"` + else + tmp=${dir}gzexe$$ ++ (umask 77; set -C; > "$tmp") + fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || { + res=$? + printf >&2 '%s\n' "$0: cannot copy $file" +diff --git a/zdiff.in b/zdiff.in +index 289e466..53266df 100644 +--- a/zdiff.in ++++ b/zdiff.in +@@ -156,12 +156,11 @@ case $file2 in + *) TMPDIR=/tmp/;; + esac + if type mktemp >/dev/null 2>&1; then +- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` || +- exit 2 ++ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` + else +- set -C + tmp=${TMPDIR}zdiff$$ +- fi ++ (umask 77; set -C; > "$tmp") ++ fi && + 'gzip' -cdfq -- "$file2" > "$tmp" || exit 2 + gzip_status=$( + exec 4>&1 +-- +cgit v1.2.3 + diff --git a/SOURCES/CVE-2026-41992.patch b/SOURCES/CVE-2026-41992.patch new file mode 100644 index 0000000..f1ae3c0 --- /dev/null +++ b/SOURCES/CVE-2026-41992.patch @@ -0,0 +1,36 @@ +From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Wed, 15 Apr 2026 12:00:17 -0700 +Subject: gzip: don’t mishandle .lzh after .Z +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Problem reported by Michał Majchrowicz. +* unlzh.c (read_c_len): Clear left and right when n == 0. +--- + NEWS | 4 ++++ + THANKS | 1 + + unlzh.c | 6 ++++++ + 3 files changed, 11 insertions(+) + +diff --git a/unlzh.c b/unlzh.c +index 2522764..c3e92ff 100644 +--- a/unlzh.c ++++ b/unlzh.c +@@ -313,6 +307,12 @@ decode_p () + + local void huf_decode_start() + { ++ /* Needed in case LEFT and RIGHT are reused from a previous ++ LZW decompression. It may be overkill to clear all of both ++ arrays, but nobody has had time to analyze this carefully. */ ++ memzero (left, (2 * NC - 1) * sizeof *left); ++ memzero (right, (2 * NC - 1) * sizeof *right); ++ + init_getbits(); blocksize = 0; + } + +-- +cgit v1.3 + diff --git a/SOURCES/gnulib.patch b/SOURCES/gnulib.patch deleted file mode 100644 index 68e8d51..0000000 --- a/SOURCES/gnulib.patch +++ /dev/null @@ -1,189 +0,0 @@ -From 1831628c0630ae96a43586b2a25ca51cbdba3e53 Mon Sep 17 00:00:00 2001 -From: Paul Eggert -Date: Mon, 5 Mar 2018 10:56:29 -0800 -Subject: [PATCH] fflush: adjust to glibc 2.28 libio.h removal -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Problem reported by Daniel P. Berrangé in: -https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html -* lib/fbufmode.c (fbufmode): -* lib/fflush.c (clear_ungetc_buffer_preserving_position) -(disable_seek_optimization, rpl_fflush): -* lib/fpending.c (__fpending): -* lib/fpurge.c (fpurge): -* lib/freadable.c (freadable): -* lib/freadahead.c (freadahead): -* lib/freading.c (freading): -* lib/freadptr.c (freadptr): -* lib/freadseek.c (freadptrinc): -* lib/fseeko.c (fseeko): -* lib/fseterr.c (fseterr): -* lib/fwritable.c (fwritable): -* lib/fwriting.c (fwriting): -Check _IO_EOF_SEEN instead of _IO_ftrylockfile. -* lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]: -Define if not already defined. ---- - ChangeLog | 23 +++++++++++++++++++++++ - lib/fbufmode.c | 2 +- - lib/fflush.c | 6 +++--- - lib/fpending.c | 2 +- - lib/fpurge.c | 2 +- - lib/freadable.c | 2 +- - lib/freadahead.c | 2 +- - lib/freading.c | 2 +- - lib/freadptr.c | 2 +- - lib/freadseek.c | 2 +- - lib/fseeko.c | 4 ++-- - lib/fseterr.c | 2 +- - lib/fwritable.c | 2 +- - lib/fwriting.c | 2 +- - lib/stdio-impl.h | 6 ++++++ - 15 files changed, 45 insertions(+), 16 deletions(-) - -diff --git a/ChangeLog b/ChangeLog -index 667f91663..beb835670 100644 ---- a/ChangeLog -+++ b/ChangeLog -@@ -1,3 +1,26 @@ -+2018-03-05 Paul Eggert -+ -+ fflush: adjust to glibc 2.28 libio.h removal -+ Problem reported by Daniel P. Berrangé in: -+ https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html -+ * lib/fbufmode.c (fbufmode): -+ * lib/fflush.c (clear_ungetc_buffer_preserving_position) -+ (disable_seek_optimization, rpl_fflush): -+ * lib/fpending.c (__fpending): -+ * lib/fpurge.c (fpurge): -+ * lib/freadable.c (freadable): -+ * lib/freadahead.c (freadahead): -+ * lib/freading.c (freading): -+ * lib/freadptr.c (freadptr): -+ * lib/freadseek.c (freadptrinc): -+ * lib/fseeko.c (fseeko): -+ * lib/fseterr.c (fseterr): -+ * lib/fwritable.c (fwritable): -+ * lib/fwriting.c (fwriting): -+ Check _IO_EOF_SEEN instead of _IO_ftrylockfile. -+ * lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]: -+ Define if not already defined. -+ - 2018-01-07 Jim Meyering - - version 1.9 - * NEWS: Record release date. -diff --git a/lib/fflush.c b/lib/fflush.c -index 983ade0ff..a6edfa105 100644 ---- a/lib/fflush.c -+++ b/lib/fflush.c -@@ -33,7 +33,7 @@ - #undef fflush - - --#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - - /* Clear the stream's ungetc buffer, preserving the value of ftello (fp). */ - static void -@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp) - - #endif - --#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */) -+#if ! (defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */) - - # if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT - /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */ -@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream) - if (stream == NULL || ! freading (stream)) - return fflush (stream); - --#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - - clear_ungetc_buffer_preserving_position (stream); - -diff --git a/lib/fpurge.c b/lib/fpurge.c -index b1d417c7a..3aedcc373 100644 ---- a/lib/fpurge.c -+++ b/lib/fpurge.c -@@ -62,7 +62,7 @@ fpurge (FILE *fp) - /* Most systems provide FILE as a struct and the necessary bitmask in - , because they need it for implementing getc() and putc() as - fast macros. */ --# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - fp->_IO_read_end = fp->_IO_read_ptr; - fp->_IO_write_ptr = fp->_IO_write_base; - /* Avoid memory leak when there is an active ungetc buffer. */ -diff --git a/lib/freading.c b/lib/freading.c -index 73c28acdd..c24d0c88a 100644 ---- a/lib/freading.c -+++ b/lib/freading.c -@@ -31,7 +31,7 @@ freading (FILE *fp) - /* Most systems provide FILE as a struct and the necessary bitmask in - , because they need it for implementing getc() and putc() as - fast macros. */ --# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - return ((fp->_flags & _IO_NO_WRITES) != 0 - || ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0 - && fp->_IO_read_base != NULL)); -diff --git a/lib/fseeko.c b/lib/fseeko.c -index 0101ab55f..193f4e8ce 100644 ---- a/lib/fseeko.c -+++ b/lib/fseeko.c -@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence) - #endif - - /* These tests are based on fpurge.c. */ --#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - if (fp->_IO_read_end == fp->_IO_read_ptr - && fp->_IO_write_ptr == fp->_IO_write_base - && fp->_IO_save_base == NULL) -@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence) - return -1; - } - --#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - fp->_flags &= ~_IO_EOF_SEEN; - fp->_offset = pos; - #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__ -diff --git a/lib/fseterr.c b/lib/fseterr.c -index 82649c3ac..adb637256 100644 ---- a/lib/fseterr.c -+++ b/lib/fseterr.c -@@ -29,7 +29,7 @@ fseterr (FILE *fp) - /* Most systems provide FILE as a struct and the necessary bitmask in - , because they need it for implementing getc() and putc() as - fast macros. */ --#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ -+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */ - fp->_flags |= _IO_ERR_SEEN; - #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__ - /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */ -diff --git a/lib/stdio-impl.h b/lib/stdio-impl.h -index 78d896e9f..05c5752a2 100644 ---- a/lib/stdio-impl.h -+++ b/lib/stdio-impl.h -@@ -18,6 +18,12 @@ - the same implementation of stdio extension API, except that some fields - have different naming conventions, or their access requires some casts. */ - -+/* Glibc 2.28 made _IO_IN_BACKUP private. For now, work around this -+ problem by defining it ourselves. FIXME: Do not rely on glibc -+ internals. */ -+#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN -+# define _IO_IN_BACKUP 0x100 -+#endif - - /* BSD stdio derived implementations. */ - --- -2.14.3 - diff --git a/SPECS/gzip.spec b/SPECS/gzip.spec index d4eb28c..cb4e4ce 100644 --- a/SPECS/gzip.spec +++ b/SPECS/gzip.spec @@ -1,7 +1,7 @@ Summary: The GNU data compression program Name: gzip Version: 1.12 -Release: 1%{?dist} +Release: 2%{?dist} # info pages are under GFDL license License: GPLv3+ and GFDL Source0: http://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz @@ -11,8 +11,16 @@ Source1: https://www.gnu.org/licenses/fdl-1.3.txt Source100: colorzgrep.csh Source101: colorzgrep.sh -Patch1: gnulib.patch +#Patch1: gnulib.patch Patch2: gzexe.patch +#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269 +Patch3: CVE-2026-41991.patch +# Regarding the following two links: +# The second one reverts the first one and then applies the changes, +# since the first one is not being used here, the reverting part has been removed +#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681 +#http://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d +Patch4: CVE-2026-41992.patch # Fixed in upstream code. # http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378 @@ -42,6 +50,8 @@ very commonly used data compression program. %setup -q #%patch1 -p1 -b .gnulib %patch2 -p1 -b .gzexe +%patch3 -p1 +%patch4 -p1 cp %{SOURCE1} . autoreconf @@ -90,6 +100,12 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir} %{profiledir}/* %changelog +* Fri Aug 14 2026 Jakub Martisko - 1.12-2 +- Fix an issue with a temporary file creations when mktemp is missing (41991) +- Fix a global buffer overflow vulnerability in the LZH decompression logic (41992) +Resolves: CVE-2026-41991 +Resolves: CVE-2026-41992 + * Fri Apr 22 2022 Jakub Martisko - 1.12-1 - Rebase to gzip 1.12 - Resolves an arbitrary-file-write vulnerability in zgrep