Backport upstream commit c9da977c178f to fix CVE-2026-58016.
The patch corrects a broken nesting check for `<node>` elements
in the D-Bus introspection XML parser (gio/gdbusintrospection.c)
and adds unit tests for invalid XML parsing
(gio/tests/gdbus-introspection.c).
CVE: CVE-2026-58016
Upstream patches:
- https://github.com/GNOME/glib/commit/c9da977c178f.patch
Resolves: RHEL-190617
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58014 from GitLab MR !5171
(commit 5f6d86b5) to mingw-glib2 2.70.1. The patch fixes a
one-byte heap under-read in g_key_file_get_locale_string_list()
when called on a key with an empty value (len == 0). The fix
adds a `len > 0` guard in glib/gkeyfile.c. The patch also
includes a fuzzing test extension and a unit test.
CVE: CVE-2026-58014
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171.patch
Resolves: RHEL-190609
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-58015 which validates
D-Bus SHA-1 authentication cookie contexts to prevent
path traversal attacks. The patch includes five upstream
commits that add cookie context validation, cookie ID range
checks, and hardening of the keyring file parser, with
C99 types adapted to GLib equivalents for compatibility
with the older GLib 2.70.1 codebase.
CVE: CVE-2026-58015
Upstream patches:
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5172.patch
Resolves: RHEL-212246
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
