Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package speex for openSUSE:Factory checked in at 2026-10-28 17:45:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/speex (Old) and /work/SRC/openSUSE:Factory/.speex.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "speex" Wed Oct 28 17:45:51 2026 rev:34 rq:1393138 version:1.2.1 Changes: -------- --- /work/SRC/openSUSE:Factory/speex/speex.changes 2024-02-27 22:45:48.397008435 +0100 +++ /work/SRC/openSUSE:Factory/.speex.new.2252680/speex.changes 2026-10-28 17:45:55.071482365 +0100 @@ -1,0 +2,8 @@ +Tue Oct 27 14:55:09 UTC 2026 - Takashi Iwai <[email protected]> + +- Fix out-of-bounds write in speex_bits_read_whole_bytes() + (CVE-2026-116741, bsc#1288101): + speex-CVE-2026-116741.patch +- Refresh speex-no-build-date.patch to be applied with -p1 + +------------------------------------------------------------------- New: ---- speex-CVE-2026-116741.patch ----------(New B)---------- New: (CVE-2026-116741, bsc#1288101): speex-CVE-2026-116741.patch - Refresh speex-no-build-date.patch to be applied with -p1 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ speex.spec ++++++ --- /var/tmp/diff_new_pack.s85yof/_old 2026-10-28 17:45:56.178528702 +0100 +++ /var/tmp/diff_new_pack.s85yof/_new 2026-10-28 17:45:56.182528869 +0100 @@ -1,7 +1,7 @@ # # spec file for package speex # -# Copyright (c) 2022 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -27,6 +27,7 @@ Source0: https://downloads.xiph.org/releases/speex/%{name}-%{version}.tar.gz Source1: baselibs.conf Patch0: speex-no-build-date.patch +Patch1: speex-CVE-2026-116741.patch BuildRequires: pkgconfig BuildRequires: pkgconfig(ogg) BuildRequires: pkgconfig(speexdsp) @@ -62,7 +63,7 @@ SpeeX library. %prep -%autosetup -p0 +%autosetup -p1 %build %configure \ ++++++ speex-CVE-2026-116741.patch ++++++ >From ab81029d743b7cdca2a36be64d8b77e9265529c3 Mon Sep 17 00:00:00 2001 From: Tristan Matthews <[email protected]> Date: Thu, 22 Oct 2026 09:00:44 -0400 Subject: [PATCH] bits: fix OOB write in read_whole_bytes for non-owned buffers Fixes https://github.com/xiph/speex/issues/42 Reported by HaiND (Nguyen Dinh Hai), Post and Telecommunication Institute of Technology, github.com/Haind03. --- libspeex/bits.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libspeex/bits.c b/libspeex/bits.c index 4f457af1..c5546e89 100644 --- a/libspeex/bits.c +++ b/libspeex/bits.c @@ -174,7 +174,7 @@ EXPORT void speex_bits_read_whole_bytes(SpeexBits *bits, const char *chars, int } } else { speex_warning("Do not own input buffer: truncating oversize input"); - nchars=bits->buf_size; + nchars=bits->buf_size-(bits->nbBits>>LOG2_BITS_PER_CHAR)-1; } } ++++++ speex-no-build-date.patch ++++++ --- /var/tmp/diff_new_pack.s85yof/_old 2026-10-28 17:45:56.266532386 +0100 +++ /var/tmp/diff_new_pack.s85yof/_new 2026-10-28 17:45:56.273532679 +0100 @@ -1,7 +1,10 @@ -Index: src/speexdec.c -=================================================================== ---- src/speexdec.c.orig -+++ src/speexdec.c +--- + src/speexdec.c | 2 +- + src/speexenc.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/src/speexdec.c ++++ b/src/speexdec.c @@ -291,7 +291,7 @@ void version() { const char* speex_version; @@ -11,10 +14,8 @@ printf ("Copyright (C) 2002-2006 Jean-Marc Valin\n"); } -Index: src/speexenc.c -=================================================================== ---- src/speexenc.c.orig -+++ src/speexenc.c +--- a/src/speexenc.c ++++ b/src/speexenc.c @@ -203,7 +203,7 @@ void version() { const char* speex_version;
