Fix CVE-2026-41991 and CVE-2026-41992
Resolves: RHEL-215645 Resolves: RHEL-218148
This commit is contained in:
Jakub Martisko
parent
9063a33180
commit
6e7b874c40
54
CVE-2026-41991.patch
Normal file
54
CVE-2026-41991.patch
Normal file
@ -0,0 +1,54 @@
|
||||
From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||||
Date: Thu, 16 Apr 2026 12:11:44 -0700
|
||||
Subject: gzexe: use -C if lacking mktemp
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
(Problem reported by Michał Majchrowicz.)
|
||||
* gzexe.in: If mktemp is needed but not installed,
|
||||
use ‘set -C’ to avoid a race when creating a temporary file.
|
||||
* zdiff.in: Use the same pattern here, even though the old
|
||||
code was probably OK anyway.
|
||||
---
|
||||
NEWS | 5 +++++
|
||||
gzexe.in | 1 +
|
||||
zdiff.in | 7 +++----
|
||||
3 files changed, 9 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/gzexe.in b/gzexe.in
|
||||
index ea4ef94..f3d46cc 100644
|
||||
--- a/gzexe.in
|
||||
+++ b/gzexe.in
|
||||
@@ -127,6 +127,7 @@ for i do
|
||||
tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
|
||||
else
|
||||
tmp=${dir}gzexe$$
|
||||
+ (umask 77; set -C; > "$tmp")
|
||||
fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
|
||||
res=$?
|
||||
printf >&2 '%s\n' "$0: cannot copy $file"
|
||||
diff --git a/zdiff.in b/zdiff.in
|
||||
index 289e466..53266df 100644
|
||||
--- a/zdiff.in
|
||||
+++ b/zdiff.in
|
||||
@@ -156,12 +156,11 @@ case $file2 in
|
||||
*) TMPDIR=/tmp/;;
|
||||
esac
|
||||
if type mktemp >/dev/null 2>&1; then
|
||||
- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
|
||||
- exit 2
|
||||
+ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
|
||||
else
|
||||
- set -C
|
||||
tmp=${TMPDIR}zdiff$$
|
||||
- fi
|
||||
+ (umask 77; set -C; > "$tmp")
|
||||
+ fi &&
|
||||
'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
|
||||
gzip_status=$(
|
||||
exec 4>&1
|
||||
--
|
||||
cgit v1.2.3
|
||||
|
||||
36
CVE-2026-41992.patch
Normal file
36
CVE-2026-41992.patch
Normal file
@ -0,0 +1,36 @@
|
||||
From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Eggert <eggert@cs.ucla.edu>
|
||||
Date: Wed, 15 Apr 2026 12:00:17 -0700
|
||||
Subject: gzip: don’t mishandle .lzh after .Z
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Problem reported by Michał Majchrowicz.
|
||||
* unlzh.c (read_c_len): Clear left and right when n == 0.
|
||||
---
|
||||
NEWS | 4 ++++
|
||||
THANKS | 1 +
|
||||
unlzh.c | 6 ++++++
|
||||
3 files changed, 11 insertions(+)
|
||||
|
||||
diff --git a/unlzh.c b/unlzh.c
|
||||
index 2522764..c3e92ff 100644
|
||||
--- a/unlzh.c
|
||||
+++ b/unlzh.c
|
||||
@@ -313,6 +307,12 @@ decode_p ()
|
||||
static void
|
||||
huf_decode_start ()
|
||||
{
|
||||
+ /* Needed in case LEFT and RIGHT are reused from a previous
|
||||
+ LZW decompression. It may be overkill to clear all of both
|
||||
+ arrays, but nobody has had time to analyze this carefully. */
|
||||
+ memzero (left, (2 * NC - 1) * sizeof *left);
|
||||
+ memzero (right, (2 * NC - 1) * sizeof *right);
|
||||
+
|
||||
init_getbits(); blocksize = 0;
|
||||
}
|
||||
|
||||
--
|
||||
cgit v1.3
|
||||
|
||||
21
gzip.spec
21
gzip.spec
@ -1,7 +1,7 @@
|
||||
Summary: GNU data compression program
|
||||
Name: gzip
|
||||
Version: 1.13
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
# info pages are under GFDL license
|
||||
License: GPL-3.0-or-later AND GFDL-1.3-only
|
||||
Source0: https://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
|
||||
@ -11,7 +11,15 @@ Source1: https://www.gnu.org/licenses/fdl-1.3.txt
|
||||
Source100: colorzgrep.csh
|
||||
Source101: colorzgrep.sh
|
||||
|
||||
Patch1: gnulib.patch
|
||||
|
||||
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
|
||||
Patch1: CVE-2026-41991.patch
|
||||
# Regarding the following two links:
|
||||
# The second one reverts the first one and then applies the changes,
|
||||
# since the first one is not being used here, the reverting part has been removed
|
||||
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
|
||||
#http://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d
|
||||
Patch2: CVE-2026-41992.patch
|
||||
|
||||
# Fixed in upstream code.
|
||||
# http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378
|
||||
@ -39,7 +47,8 @@ very commonly used data compression program.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
#%patch1 -p1 -b .gnulib
|
||||
%patch 1 -p1
|
||||
%patch 2 -p1
|
||||
cp %{SOURCE1} .
|
||||
autoreconf
|
||||
|
||||
@ -86,6 +95,12 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir}
|
||||
%{profiledir}/*
|
||||
|
||||
%changelog
|
||||
* Fri Aug 14 2026 Jakub Martisko <jamartis@redhat.com> - 1.13-4
|
||||
- Fix an issue with a temporary file creations when mktemp is missing (41991)
|
||||
- Fix a global buffer overflow vulnerability in the LZH decompression logic (41992)
|
||||
Resolves: CVE-2026-41991
|
||||
Resolves: CVE-2026-41992
|
||||
|
||||
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.13-3
|
||||
- Bump release for October 2024 mass rebuild:
|
||||
Resolves: RHEL-64018
|
||||
|
||||
Loading…
Reference in New Issue
Block a user