From 4d1cf8cecb4b2812f728cca3b8a6698870d2fb5b Mon Sep 17 00:00:00 2001 From: Pavel Cahyna Date: Mon, 24 Aug 2026 15:03:08 +0200 Subject: [PATCH] Bump Release, update %changelog Resolves: RHEL-234448 --- tar.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tar.spec b/tar.spec index f301956..0d67e28 100644 --- a/tar.spec +++ b/tar.spec @@ -10,7 +10,7 @@ Summary: GNU file archiving program Name: tar Epoch: 2 Version: 1.35 -Release: 12%{?dist} +Release: 13%{?dist} License: GPL-3.0-or-later URL: https://www.gnu.org/software/tar/ @@ -183,6 +183,14 @@ make check || ( %changelog +* Mon Aug 24 2026 Pavel Cahyna - 2:1.35-13 +- Backport upstream patches for CVE-2026-18477, fixes a bug + where incremental restore with cyclic renames between backups + may create a temporary directory at an archive-controlled path + outside the extraction tree. + The fix for CVE-2025-45582 already prevents exploiting + this problem, so it is more a correctness and hardening change. + * Fri Aug 21 2026 Pavel Cahyna - 2:1.35-12 - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)