This is primarily a security release fixing two CVEs and a buffer overrun in `%lang` parsing. A couple of 6.0.0 regressions (and one 4.20.0 regression) is also addressed here.
Note commit 33ac20e4d1e6ffb1c1baec2271fda13ebd82466c: This is to avoid a compilation warning with GCC >= 16 (currently in the latest Fedora 44). You can view, comment on, or merge this pull request online at: https://github.com/rpm-software-management/rpm/pull/4282 -- Commit Summary -- * Fix delete_key_compat() friend definition * Silence a Clang warning about unused return value in fsm * tests: Adjust policy for current sequoia * Prevent buffer overruns in findPreambleTag() for language string * Fix regression running Lua scripts from non-rpm generated packages * Bump rpm-sequoia requirement to >= 1.10.2 * Prevent command injection in rpmuncompress(1) * Add a test for the manual "%add_sysuser m" use * Fix typo in add_sysuser ternary * Add a test for CVE-2026-44605 * Harden the ndb implementation against integer overflows * Preparing for 6.0.2 release -- File Changes -- M CMakeLists.txt (4) M build/parsePreamble.cc (12) M lib/backend/ndb/rpmidx.c (23) M lib/backend/ndb/rpmpkg.c (44) M lib/backend/ndb/rpmxdb.c (16) M lib/fsm.cc (5) M lib/keystore.cc (2) M lib/rpmscript.cc (17) M macros.in (2) M tests/Dockerfile.fedora (2) A tests/data/RPMS/mwe-rpm-lua-problem-1.0.0-1.noarch.rpm (0) A tests/data/SOURCES/source-singleroot-evil.zip (0) A tests/data/SPECS/autosetup-singleroot-evil.spec (13) A tests/data/SPECS/preamble-lang.spec (11) A tests/data/misc/ndb-corruptor.c (50) M tests/pinned/rpmlibver.txt (8) M tests/pinned/rpmsigdig.txt (6) M tests/pinned/rpmsigdig6.txt (4) M tests/rpmbuild.at (9) M tests/rpmdb.at (26) M tests/rpmi.at (34) M tests/rpmsigdig.at (1) M tests/rpmspec.at (11) M tools/rpmuncompress.cc (4) -- Patch Links -- https://github.com/rpm-software-management/rpm/pull/4282.patch https://github.com/rpm-software-management/rpm/pull/4282.diff -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/4282 You are receiving this because you are subscribed to this thread. Message ID: <rpm-software-management/rpm/pull/[email protected]>
_______________________________________________ Rpm-maint mailing list [email protected] https://lists.rpm.org/mailman/listinfo/rpm-maint
