diff --git a/SPECS/glib/CVE-2025-13601.patch b/SPECS/glib/CVE-2025-13601.patch new file mode 100644 index 00000000000..1ce50eed3c9 --- /dev/null +++ b/SPECS/glib/CVE-2025-13601.patch @@ -0,0 +1,135 @@ +From 2b526a5548dfcb99e1355fb70ba6b22f91bd673a Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Thu, 13 Nov 2025 18:27:22 +0000 +Subject: [PATCH] gconvert: Error out if g_escape_uri_string() would overflow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If the string to escape contains a very large number of unacceptable +characters (which would need escaping), the calculation of the length of +the escaped string could overflow, leading to a potential write off the +end of the newly allocated string. + +In addition to that, the number of unacceptable characters was counted +in a signed integer, which would overflow to become negative, making it +easier for an attacker to craft an input string which would cause an +out-of-bounds write. + +Fix that by validating the allocation length, and using an unsigned +integer to count the number of unacceptable characters. + +Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme +from the Sovereign Tech Agency. ID: #YWH-PGM9867-134 + +Signed-off-by: Philip Withnall + +Fixes: #3827 + +Backport 2.86: Changed the translatable error message to re-use an +existing translatable string, to avoid adding new translatable strings +to a stable branch. The re-used string doesn’t perfectly match the +error, but it’s good enough given that no users will ever see it. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://gitlab.gnome.org/GNOME/glib/-/commit/9bcd65ba5fa1b92ff0fb8380faea335ccef56253.patch +--- + glib/gconvert.c | 36 +++++++++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +diff --git a/glib/gconvert.c b/glib/gconvert.c +index cb0dcaa..e15ca0d 100644 +--- a/glib/gconvert.c ++++ b/glib/gconvert.c +@@ -1425,8 +1425,9 @@ static const gchar hex[16] = "0123456789ABCDEF"; + /* Note: This escape function works on file: URIs, but if you want to + * escape something else, please read RFC-2396 */ + static gchar * +-g_escape_uri_string (const gchar *string, +- UnsafeCharacterSet mask) ++g_escape_uri_string (const gchar *string, ++ UnsafeCharacterSet mask, ++ GError **error) + { + #define ACCEPTABLE(a) ((a)>=32 && (a)<128 && (acceptable[(a)-32] & use_mask)) + +@@ -1434,7 +1435,7 @@ g_escape_uri_string (const gchar *string, + gchar *q; + gchar *result; + int c; +- gint unacceptable; ++ size_t unacceptable; + UnsafeCharacterSet use_mask; + + g_return_val_if_fail (mask == UNSAFE_ALL +@@ -1451,7 +1452,14 @@ g_escape_uri_string (const gchar *string, + if (!ACCEPTABLE (c)) + unacceptable++; + } +- ++ ++ if (unacceptable >= (G_MAXSIZE - (p - string)) / 2) ++ { ++ g_set_error_literal (error, G_CONVERT_ERROR, G_CONVERT_ERROR_BAD_URI, ++ _("Invalid hostname")); ++ return NULL; ++ } ++ + result = g_malloc (p - string + unacceptable * 2 + 1); + + use_mask = mask; +@@ -1476,12 +1484,13 @@ g_escape_uri_string (const gchar *string, + + + static gchar * +-g_escape_file_uri (const gchar *hostname, +- const gchar *pathname) ++g_escape_file_uri (const gchar *hostname, ++ const gchar *pathname, ++ GError **error) + { + char *escaped_hostname = NULL; +- char *escaped_path; +- char *res; ++ char *escaped_path = NULL; ++ char *res = NULL; + + #ifdef G_OS_WIN32 + char *p, *backslash; +@@ -1502,10 +1511,14 @@ g_escape_file_uri (const gchar *hostname, + + if (hostname && *hostname != '\0') + { +- escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST); ++ escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST, error); ++ if (escaped_hostname == NULL) ++ goto out; + } + +- escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH); ++ escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH, error); ++ if (escaped_path == NULL) ++ goto out; + + res = g_strconcat ("file://", + (escaped_hostname) ? escaped_hostname : "", +@@ -1513,6 +1526,7 @@ g_escape_file_uri (const gchar *hostname, + escaped_path, + NULL); + ++out: + #ifdef G_OS_WIN32 + g_free ((char *) pathname); + #endif +@@ -1832,7 +1846,7 @@ g_filename_to_uri (const gchar *filename, + hostname = NULL; + #endif + +- escaped_uri = g_escape_file_uri (hostname, filename); ++ escaped_uri = g_escape_file_uri (hostname, filename, error); + + return escaped_uri; + } +-- +2.45.4 + diff --git a/SPECS/glib/glib.spec b/SPECS/glib/glib.spec index e4c8eadaee1..1be127ac02e 100644 --- a/SPECS/glib/glib.spec +++ b/SPECS/glib/glib.spec @@ -2,7 +2,7 @@ Summary: Low-level libraries useful for providing data structure handling for C. Name: glib Version: 2.71.0 -Release: 7%{?dist} +Release: 8%{?dist} License: LGPLv2+ Vendor: Microsoft Corporation Distribution: Mariner @@ -16,6 +16,7 @@ Patch2: CVE-2023-32643-CVE-2023-32636.patch Patch3: CVE-2025-3360.patch Patch4: CVE-2025-4373.patch Patch5: CVE-2025-7039.patch +Patch6: CVE-2025-13601.patch BuildRequires: cmake BuildRequires: gtk-doc BuildRequires: libffi-devel @@ -129,6 +130,9 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache %doc %{_datadir}/gtk-doc/html/* %changelog +* Sat Nov 29 2025 Azure Linux Security Servicing Account - 2.71.0-8 +- Patch for CVE-2025-13601 + * Mon Sep 08 2025 Azure Linux Security Servicing Account - 2.71.0-7 - Patch for CVE-2025-7039 @@ -162,7 +166,7 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache * Wed May 19 2021 Thomas Crain - 2.60.1-4 - Require schemas subpackage from devel subpackage -* Fri Apr 27 2021 Thomas Crain - 2.60.1-3 +* Tue Apr 27 2021 Thomas Crain - 2.60.1-3 - Remove CVE-2019-13012 patch (already in the this version) - Exclude doubly-packaged files from devel subpackage - Merge the following releases from 1.0 to dev branch diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 83a7b0a92e4..1e43de31d64 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -199,7 +199,7 @@ libxml2-devel-2.10.4-9.cm2.aarch64.rpm docbook-dtd-xml-4.5-11.cm2.noarch.rpm docbook-style-xsl-1.79.1-14.cm2.noarch.rpm libsepol-3.2-2.cm2.aarch64.rpm -glib-2.71.0-7.cm2.aarch64.rpm +glib-2.71.0-8.cm2.aarch64.rpm libltdl-2.4.6-8.cm2.aarch64.rpm libltdl-devel-2.4.6-8.cm2.aarch64.rpm pcre-8.45-2.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 1fa194cee03..c2f0e9f147b 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -199,7 +199,7 @@ libxml2-devel-2.10.4-9.cm2.x86_64.rpm docbook-dtd-xml-4.5-11.cm2.noarch.rpm docbook-style-xsl-1.79.1-14.cm2.noarch.rpm libsepol-3.2-2.cm2.x86_64.rpm -glib-2.71.0-7.cm2.x86_64.rpm +glib-2.71.0-8.cm2.x86_64.rpm libltdl-2.4.6-8.cm2.x86_64.rpm libltdl-devel-2.4.6-8.cm2.x86_64.rpm pcre-8.45-2.cm2.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 4c5c5b82651..5c1cb3a5a9a 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -101,11 +101,11 @@ gdbm-lang-1.21-1.cm2.aarch64.rpm gettext-0.21-3.cm2.aarch64.rpm gettext-debuginfo-0.21-3.cm2.aarch64.rpm gfortran-11.2.0-9.cm2.aarch64.rpm -glib-2.71.0-7.cm2.aarch64.rpm -glib-debuginfo-2.71.0-7.cm2.aarch64.rpm -glib-devel-2.71.0-7.cm2.aarch64.rpm -glib-doc-2.71.0-7.cm2.noarch.rpm -glib-schemas-2.71.0-7.cm2.aarch64.rpm +glib-2.71.0-8.cm2.aarch64.rpm +glib-debuginfo-2.71.0-8.cm2.aarch64.rpm +glib-devel-2.71.0-8.cm2.aarch64.rpm +glib-doc-2.71.0-8.cm2.noarch.rpm +glib-schemas-2.71.0-8.cm2.aarch64.rpm glibc-2.35-7.cm2.aarch64.rpm glibc-debuginfo-2.35-7.cm2.aarch64.rpm glibc-devel-2.35-7.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 8e805e4b2a7..618201be521 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -106,11 +106,11 @@ gdbm-lang-1.21-1.cm2.x86_64.rpm gettext-0.21-3.cm2.x86_64.rpm gettext-debuginfo-0.21-3.cm2.x86_64.rpm gfortran-11.2.0-9.cm2.x86_64.rpm -glib-2.71.0-7.cm2.x86_64.rpm -glib-debuginfo-2.71.0-7.cm2.x86_64.rpm -glib-devel-2.71.0-7.cm2.x86_64.rpm -glib-doc-2.71.0-7.cm2.noarch.rpm -glib-schemas-2.71.0-7.cm2.x86_64.rpm +glib-2.71.0-8.cm2.x86_64.rpm +glib-debuginfo-2.71.0-8.cm2.x86_64.rpm +glib-devel-2.71.0-8.cm2.x86_64.rpm +glib-doc-2.71.0-8.cm2.noarch.rpm +glib-schemas-2.71.0-8.cm2.x86_64.rpm glibc-2.35-7.cm2.x86_64.rpm glibc-debuginfo-2.35-7.cm2.x86_64.rpm glibc-devel-2.35-7.cm2.x86_64.rpm