diff --git a/SPECS/glib/CVE-2026-0988.patch b/SPECS/glib/CVE-2026-0988.patch new file mode 100644 index 00000000000..e463aec2503 --- /dev/null +++ b/SPECS/glib/CVE-2026-0988.patch @@ -0,0 +1,59 @@ +From 4d42b6961af1ff14309093b4b51f74e7a84cc950 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Thu, 18 Dec 2025 23:12:18 +0000 +Subject: [PATCH] gbufferedinputstream: Fix a potential integer overflow in + peek() + +If the caller provides `offset` and `count` arguments which overflow, +their sum will overflow and could lead to `memcpy()` reading out more +memory than expected. + +Spotted by Codean Labs. + +Signed-off-by: Philip Withnall + +Fixes: #3851 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://gitlab.gnome.org/GNOME/glib/-/commit/c5766cff61ffce0b8e787eae09908ac348338e5f.patch +--- + gio/gbufferedinputstream.c | 2 +- + gio/tests/buffered-input-stream.c | 10 ++++++++++ + 2 files changed, 11 insertions(+), 1 deletion(-) + +diff --git a/gio/gbufferedinputstream.c b/gio/gbufferedinputstream.c +index 1729ebd..72437c3 100644 +--- a/gio/gbufferedinputstream.c ++++ b/gio/gbufferedinputstream.c +@@ -590,7 +590,7 @@ g_buffered_input_stream_peek (GBufferedInputStream *stream, + + available = g_buffered_input_stream_get_available (stream); + +- if (offset > available) ++ if (offset > available || offset > G_MAXSIZE - count) + return 0; + + end = MIN (offset + count, available); +diff --git a/gio/tests/buffered-input-stream.c b/gio/tests/buffered-input-stream.c +index 321654d..5d3e976 100644 +--- a/gio/tests/buffered-input-stream.c ++++ b/gio/tests/buffered-input-stream.c +@@ -60,6 +60,16 @@ test_peek (void) + g_assert_cmpint (npeek, ==, 0); + g_free (buffer); + ++ buffer = g_new0 (char, 64); ++ npeek = g_buffered_input_stream_peek (G_BUFFERED_INPUT_STREAM (in), buffer, 8, 0); ++ g_assert_cmpint (npeek, ==, 0); ++ g_free (buffer); ++ ++ buffer = g_new0 (char, 64); ++ npeek = g_buffered_input_stream_peek (G_BUFFERED_INPUT_STREAM (in), buffer, 5, G_MAXSIZE); ++ g_assert_cmpint (npeek, ==, 0); ++ g_free (buffer); ++ + g_object_unref (in); + g_object_unref (base); + } +-- +2.45.4 + diff --git a/SPECS/glib/glib.spec b/SPECS/glib/glib.spec index 67ded841775..6efcb7c1ff7 100644 --- a/SPECS/glib/glib.spec +++ b/SPECS/glib/glib.spec @@ -2,7 +2,7 @@ Summary: Low-level libraries useful for providing data structure handling for C. Name: glib Version: 2.78.6 -Release: 8%{?dist} +Release: 9%{?dist} License: LGPLv2+ Vendor: Microsoft Corporation Distribution: Azure Linux @@ -19,6 +19,7 @@ Patch6: CVE-2025-14087.patch Patch7: CVE-2025-14512.patch Patch8: CVE-2026-1484.patch Patch9: CVE-2026-1489.patch +Patch10: CVE-2026-0988.patch BuildRequires: cmake BuildRequires: gtk-doc BuildRequires: libffi-devel @@ -132,6 +133,9 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache %doc %{_datadir}/gtk-doc/html/* %changelog +* Wed Mar 11 2026 Azure Linux Security Servicing Account - 2.78.6-9 +- Patch for CVE-2026-0988 + * Fri Feb 06 2026 Azure Linux Security Servicing Account - 2.78.6-8 - Patch for CVE-2026-1489 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 0aa976dbcea..6878898ae96 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -208,7 +208,7 @@ libxml2-devel-2.11.5-9.azl3.aarch64.rpm docbook-dtd-xml-4.5-11.azl3.noarch.rpm docbook-style-xsl-1.79.1-14.azl3.noarch.rpm libsepol-3.6-2.azl3.aarch64.rpm -glib-2.78.6-8.azl3.aarch64.rpm +glib-2.78.6-9.azl3.aarch64.rpm libltdl-2.4.7-1.azl3.aarch64.rpm libltdl-devel-2.4.7-1.azl3.aarch64.rpm lua-5.4.6-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 0337a6c7966..eb0bf29a3b2 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -208,7 +208,7 @@ libxml2-devel-2.11.5-9.azl3.x86_64.rpm docbook-dtd-xml-4.5-11.azl3.noarch.rpm docbook-style-xsl-1.79.1-14.azl3.noarch.rpm libsepol-3.6-2.azl3.x86_64.rpm -glib-2.78.6-8.azl3.x86_64.rpm +glib-2.78.6-9.azl3.x86_64.rpm libltdl-2.4.7-1.azl3.x86_64.rpm libltdl-devel-2.4.7-1.azl3.x86_64.rpm lua-5.4.6-1.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index cd1fb23b3f8..8f2cc428885 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -122,11 +122,11 @@ gdbm-lang-1.23-1.azl3.aarch64.rpm gettext-0.22-1.azl3.aarch64.rpm gettext-debuginfo-0.22-1.azl3.aarch64.rpm gfortran-13.2.0-7.azl3.aarch64.rpm -glib-2.78.6-8.azl3.aarch64.rpm -glib-debuginfo-2.78.6-8.azl3.aarch64.rpm -glib-devel-2.78.6-8.azl3.aarch64.rpm -glib-doc-2.78.6-8.azl3.noarch.rpm -glib-schemas-2.78.6-8.azl3.aarch64.rpm +glib-2.78.6-9.azl3.aarch64.rpm +glib-debuginfo-2.78.6-9.azl3.aarch64.rpm +glib-devel-2.78.6-9.azl3.aarch64.rpm +glib-doc-2.78.6-9.azl3.noarch.rpm +glib-schemas-2.78.6-9.azl3.aarch64.rpm glibc-2.38-18.azl3.aarch64.rpm glibc-debuginfo-2.38-18.azl3.aarch64.rpm glibc-devel-2.38-18.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 31ec6ab2ceb..64d2df76c8b 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -129,11 +129,11 @@ gdbm-lang-1.23-1.azl3.x86_64.rpm gettext-0.22-1.azl3.x86_64.rpm gettext-debuginfo-0.22-1.azl3.x86_64.rpm gfortran-13.2.0-7.azl3.x86_64.rpm -glib-2.78.6-8.azl3.x86_64.rpm -glib-debuginfo-2.78.6-8.azl3.x86_64.rpm -glib-devel-2.78.6-8.azl3.x86_64.rpm -glib-doc-2.78.6-8.azl3.noarch.rpm -glib-schemas-2.78.6-8.azl3.x86_64.rpm +glib-2.78.6-9.azl3.x86_64.rpm +glib-debuginfo-2.78.6-9.azl3.x86_64.rpm +glib-devel-2.78.6-9.azl3.x86_64.rpm +glib-doc-2.78.6-9.azl3.noarch.rpm +glib-schemas-2.78.6-9.azl3.x86_64.rpm glibc-2.38-18.azl3.x86_64.rpm glibc-debuginfo-2.38-18.azl3.x86_64.rpm glibc-devel-2.38-18.azl3.x86_64.rpm