Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fltk for openSUSE:Factory checked in at 2026-10-30 18:03:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fltk (Old) and /work/SRC/openSUSE:Factory/.fltk.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "fltk" Fri Oct 30 18:03:26 2026 rev:52 rq:1393607 version:1.3.11 Changes: -------- --- /work/SRC/openSUSE:Factory/fltk/fltk.changes 2025-05-26 18:32:54.088779910 +0200 +++ /work/SRC/openSUSE:Factory/.fltk.new.1255/fltk.changes 2026-10-30 18:03:59.171380759 +0100 @@ -1,0 +2,8 @@ +Thu Oct 29 10:40:46 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-116723: stack-based buffer overflow in `Fl_BMP_Image:load_bmp_()` can lead to crash or code execution [bsc#1288053] + CVE-2026-116724: integer overflow in `Fl_BMP_Image:load_bmp_()` can lead to heap corruption [bsc#1288054] + * fltk-CVE-2026-116723,116724.patch + +------------------------------------------------------------------- New: ---- fltk-CVE-2026-116723,116724.patch ----------(New B)---------- New: CVE-2026-116724: integer overflow in `Fl_BMP_Image:load_bmp_()` can lead to heap corruption [bsc#1288054] * fltk-CVE-2026-116723,116724.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fltk.spec ++++++ --- /var/tmp/diff_new_pack.cBdtjH/_old 2026-10-30 18:04:01.760489175 +0100 +++ /var/tmp/diff_new_pack.cBdtjH/_new 2026-10-30 18:04:01.769489552 +0100 @@ -1,7 +1,7 @@ # # spec file for package fltk # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -30,6 +30,8 @@ Patch0: fltk-1.3.4-fltk_config.patch # PATCH-FIX-OPENSUSE fltk-1.3.2-verbose_build.patch [email protected] -- Make the build verbose so the post build checks can verify the CFLAGS Patch2: fltk-1.3.2-verbose_build.patch +# CVE-2026-116723: stack-based buffer overflow in `Fl_BMP_Image:load_bmp_()` can lead to crash or code execution [bsc#1288053]|CVE-2026-116724: integer overflow in `Fl_BMP_Image:load_bmp_()` can lead to heap corruption [bsc#1288054] +Patch3: fltk-CVE-2026-116723,116724.patch BuildRequires: doxygen BuildRequires: gcc-c++ BuildRequires: libjpeg-devel ++++++ fltk-CVE-2026-116723,116724.patch ++++++ >From 3a049d8262dc759cf9737339420e8457e24c0cb1 Mon Sep 17 00:00:00 2001 From: ManoloFLTK <[email protected]> Date: Thu, 22 Oct 2026 16:17:50 +0200 Subject: [PATCH] Fix "BMP Image Loader: Stack and Heap Buffer Overflow via Crafted BMP File" (#1632) Many thanks to @Haind03 for detecting the issue and sharing a fix. --- src/Fl_BMP_Image.cxx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) Index: fltk-1.3.11/src/Fl_BMP_Image.cxx =================================================================== --- fltk-1.3.11.orig/src/Fl_BMP_Image.cxx +++ fltk-1.3.11/src/Fl_BMP_Image.cxx @@ -179,6 +179,12 @@ Fl_BMP_Image::Fl_BMP_Image(const char *b if (colors_used == 0 && depth <= 8) colors_used = 1 << depth; + if (colors_used > 256) { + fclose(fp); + w(0); h(0); d(0); ld(ERR_FORMAT); + return; + } + for (repcount = 0; repcount < colors_used; repcount ++) { // Read BGR color... if (fread(colormap[repcount], 1, 3, fp)==0) { /* ignore */ } @@ -205,7 +211,7 @@ Fl_BMP_Image::Fl_BMP_Image(const char *b w(0); h(0); d(0); ld(ERR_FORMAT); return; } - array = new uchar[w() * h() * d()]; + array = new uchar[(size_t)w() * h() * d()]; alloc_array = 1; // Read the image data...
