Backport upstream commit c2640fe5171c to fix a buffer overflow
in src/url.c convert_fname() (CVE-2026-58471). The bug was in
incorrect buffer size handling during iconv filename conversion,
where the output buffer tracking used wrong offset calculations.
The patch corrects the reallocation logic in the E2BIG branch
and simplifies the null-termination of the converted string.
CVE: CVE-2026-58471
Upstream patches:
- c2640fe517.patch
Resolves: RHEL-194521
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport fix for CVE-2026-58472 to wget-1.21.1. The patch
addresses an integer and buffer overflow in html_quote_string()
by using INT_ADD_OK for safe integer arithmetic when calculating
the output buffer size for HTML entity encoding. Also includes
the follow-up fix for an off-by-1 error in the size calculation
for each entity-encoded character, along with unit tests.
The combined fix is added as Patch6: wget-1.21-CVE-2026-58472.patch
based on upstream commits dd692d9 and f76978a.
CVE: CVE-2026-58472
Upstream patches:
- dd692d9cea.patch
- f76978a51b.patch
Resolves: RHEL-210636
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
