Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tesseract-ocr for openSUSE:Factory checked in at 2026-11-01 22:21:58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tesseract-ocr (Old) and /work/SRC/openSUSE:Factory/.tesseract-ocr.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tesseract-ocr" Sun Nov 1 22:21:58 2026 rev:29 rq:1393705 version:5.5.4 Changes: -------- --- /work/SRC/openSUSE:Factory/tesseract-ocr/tesseract-ocr.changes 2026-10-18 22:54:06.360088330 +0200 +++ /work/SRC/openSUSE:Factory/.tesseract-ocr.new.1255/tesseract-ocr.changes 2026-11-01 22:22:18.448234940 +0100 @@ -1,0 +2,18 @@ +Thu Oct 29 10:16:18 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 5.5.4: + * Hardening release: crafted-traineddata guards, Coverity + fixes, leak and robustness fixes, training-tool fixes + * Drop upstreamed patches contained in 5.5.4 (fixes + credited 2026-09-23): + tesseract-CVE-2026-88047.patch, + tesseract-CVE-2026-88048.patch, + tesseract-CVE-2026-88049.patch, + tesseract-CVE-2026-88050.patch, + tesseract-CVE-2026-88051.patch, + tesseract-CVE-2026-88052.patch, + tesseract-CVE-2026-88053.patch, + tesseract-CVE-2026-88054.patch + * Raise pkgconfig(lept) floor to >= 1.80 per upstream + +------------------------------------------------------------------- Old: ---- tesseract-5.5.3.tar.gz tesseract-CVE-2026-88047.patch tesseract-CVE-2026-88048.patch tesseract-CVE-2026-88049.patch tesseract-CVE-2026-88050.patch tesseract-CVE-2026-88051.patch tesseract-CVE-2026-88052.patch tesseract-CVE-2026-88053.patch tesseract-CVE-2026-88054.patch New: ---- tesseract-5.5.4.tar.gz ----------(Old B)---------- Old: credited 2026-09-23): tesseract-CVE-2026-88047.patch, tesseract-CVE-2026-88048.patch, Old: tesseract-CVE-2026-88047.patch, tesseract-CVE-2026-88048.patch, tesseract-CVE-2026-88049.patch, Old: tesseract-CVE-2026-88048.patch, tesseract-CVE-2026-88049.patch, tesseract-CVE-2026-88050.patch, Old: tesseract-CVE-2026-88049.patch, tesseract-CVE-2026-88050.patch, tesseract-CVE-2026-88051.patch, Old: tesseract-CVE-2026-88050.patch, tesseract-CVE-2026-88051.patch, tesseract-CVE-2026-88052.patch, Old: tesseract-CVE-2026-88051.patch, tesseract-CVE-2026-88052.patch, tesseract-CVE-2026-88053.patch, Old: tesseract-CVE-2026-88052.patch, tesseract-CVE-2026-88053.patch, tesseract-CVE-2026-88054.patch Old: tesseract-CVE-2026-88053.patch, tesseract-CVE-2026-88054.patch * Raise pkgconfig(lept) floor to >= 1.80 per upstream ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tesseract-ocr.spec ++++++ --- /var/tmp/diff_new_pack.2lVAFb/_old 2026-11-01 22:22:19.467277167 +0100 +++ /var/tmp/diff_new_pack.2lVAFb/_new 2026-11-01 22:22:19.469277250 +0100 @@ -18,29 +18,15 @@ %define lname libtesseract5 Name: tesseract-ocr -Version: 5.5.3 +Version: 5.5.4 Release: 0 Summary: Open Source OCR Engine License: Apache-2.0 AND GPL-2.0-or-later URL: https://github.com/tesseract-ocr/tesseract Source0: https://github.com/tesseract-ocr/tesseract/archive/refs/tags/%{version}.tar.gz#/tesseract-%{version}.tar.gz Source99: baselibs.conf -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88047.patch GHSA-5j2p-r5vc-q7f3 (upstream commit 1bda5079) -- bound stack buffer in Classify::ReadNormProtos (CVE-2026-88047, boo#1280925) -Patch0: tesseract-CVE-2026-88047.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88048.patch GHSA-q44c-23p6-5mw6 (upstream commit 103dc134) -- validate FullyConnected layer dims vs weight matrix (CVE-2026-88048, boo#1280929) -Patch1: tesseract-CVE-2026-88048.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88049.patch GHSA-jgq8-pprg-vc68 (upstream commit b494ac18) -- bound LSTM::Forward WriteTimeStepPart count (CVE-2026-88049, boo#1280930) -Patch2: tesseract-CVE-2026-88049.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88050.patch GHSA-7v9h-3q3m-w68g (upstream commit c94a5532) -- reject negative recoder code values (CVE-2026-88050, boo#1280931) -Patch3: tesseract-CVE-2026-88050.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88051.patch GHSA-88qp-4g94-3rf3 (upstream commit 56e09ca1) -- cap GenericVector::read reserved/size_used_ (CVE-2026-88051, boo#1280932) -Patch4: tesseract-CVE-2026-88051.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88052.patch GHSA-2hm8-q5c7-c373 (upstream commit 2d04d640) -- validate UNICHARSET load loop bound and index (CVE-2026-88052, boo#1280933) -Patch5: tesseract-CVE-2026-88052.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88053.patch GHSA-rphx-x795-5qjv (upstream commit 8b057468) -- validate inttemp counts against MAX_* bounds (CVE-2026-88053, boo#1280934) -Patch6: tesseract-CVE-2026-88053.patch -# PATCH-FIX-UPSTREAM tesseract-CVE-2026-88054.patch GHSA-f6h7-cqr4-6fx4 (upstream commit 55277123) -- reject zero-length network stack in Plumbing::DeSerialize (CVE-2026-88054, boo#1280935) -Patch7: tesseract-CVE-2026-88054.patch +# Keep the literal autoconf tool dependency: expanding it into +# perl providers is a documented spec-cleaner deviation. BuildRequires: autoconf BuildRequires: automake BuildRequires: curl-devel @@ -52,7 +38,7 @@ BuildRequires: pkgconfig(cairo) BuildRequires: pkgconfig(icu-i18n) >= 52.1 BuildRequires: pkgconfig(icu-uc) >= 52.1 -BuildRequires: pkgconfig(lept) >= 1.74 +BuildRequires: pkgconfig(lept) >= 1.80 BuildRequires: pkgconfig(libarchive) BuildRequires: pkgconfig(libtiff-4) BuildRequires: pkgconfig(pango) >= 1.38.0 @@ -81,7 +67,7 @@ %package devel Summary: Tesseract Open Source OCR Engine Development files Requires: %{lname} = %{version} -Requires: pkgconfig(lept) >= 1.74 +Requires: pkgconfig(lept) >= 1.80 Requires: pkgconfig(libarchive) %description devel ++++++ tesseract-5.5.3.tar.gz -> tesseract-5.5.4.tar.gz ++++++ ++++ 9011 lines of diff (skipped)
