From fb8699708c38eb4da572da3ae3d6eb647f5a44c5 Mon Sep 17 00:00:00 2001 From: Jakub Martisko Date: Tue, 18 Aug 2026 16:18:48 +0200 Subject: [PATCH] New version of the CVE-2026-41992 patch Resolves: RHEL-233021 --- CVE-2026-41992.patch | 26 +++++++++++++------------- gzip.spec | 15 ++++++++++++--- 2 files changed, 25 insertions(+), 16 deletions(-) diff --git a/CVE-2026-41992.patch b/CVE-2026-41992.patch index 2c3f563..f1ae3c0 100644 --- a/CVE-2026-41992.patch +++ b/CVE-2026-41992.patch @@ -15,22 +15,22 @@ Problem reported by Michał Majchrowicz. 3 files changed, 11 insertions(+) diff --git a/unlzh.c b/unlzh.c -index 3320196..a6cf109 100644 +index 2522764..c3e92ff 100644 --- a/unlzh.c +++ b/unlzh.c -@@ -232,6 +232,12 @@ read_c_len () - c = getbits(CBIT); - for (i = 0; i < NC; i++) c_len[i] = 0; - for (i = 0; i < 4096; i++) c_table[i] = c; +@@ -313,6 +307,12 @@ decode_p () + + local void huf_decode_start() + { ++ /* Needed in case LEFT and RIGHT are reused from a previous ++ LZW decompression. It may be overkill to clear all of both ++ arrays, but nobody has had time to analyze this carefully. */ ++ memzero (left, (2 * NC - 1) * sizeof *left); ++ memzero (right, (2 * NC - 1) * sizeof *right); + -+ /* Needed in case LEFT and RIGHT are reused from a previous -+ LZW decompression. It may be overkill to clear all of both -+ arrays, but nobody has had time to analyze this carefully. */ -+ memzero(left, (2 * NC - 1) * sizeof *left); -+ memzero(right, (2 * NC - 1) * sizeof *left); - } else { - i = 0; - while (i < n) { + init_getbits(); blocksize = 0; + } + -- cgit v1.3 diff --git a/gzip.spec b/gzip.spec index c5d4184..e451cad 100644 --- a/gzip.spec +++ b/gzip.spec @@ -1,7 +1,7 @@ Summary: The GNU data compression program Name: gzip Version: 1.9 -Release: 14%{?dist} +Release: 15%{?dist} # info pages are under GFDL license License: GPLv3+ and GFDL Group: Applications/File @@ -30,7 +30,11 @@ Patch11: cve-2022-1271-part3.patch #https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Patch12: CVE-2026-41991.patch -#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681 +# Regarding the following two links: +# The second one reverts the first one and then applies the changes, +# since the first one is not being used here, the reverting part has been removed +#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681 +#http://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d Patch13: CVE-2026-41992.patch # Fixed in upstream code. @@ -132,7 +136,12 @@ fi %{profiledir}/* %changelog -* Tue Apr 19 2022 Jakub Martisko - 1.9-14 +* Tue Aug 18 2026 Jakub Martisko - 1.9-15 +- Fix the wrong date in the previous changelog message +- There's an updated version of the CVE-2026-41992 fix +Resolves: CVE-2026-41992 + +* Fri Aug 14 2026 Jakub Martisko - 1.9-14 - Fix an issue with a temporary file creations when mktemp is missing (41991) - Fix a global buffer overflow vulnerability in the LZH decompression logic (41992) Resolves: CVE-2026-41991