This is primarily a security release fixing two CVEs and a buffer overrun in 
`%lang` parsing. A couple of 6.0.0 regressions (and one 4.20.0 regression) is 
also addressed here.

Note commit 33ac20e4d1e6ffb1c1baec2271fda13ebd82466c: This is to avoid a 
compilation warning with GCC >= 16 (currently in the latest Fedora 44).
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/4282

-- Commit Summary --

  * Fix delete_key_compat() friend definition
  * Silence a Clang warning about unused return value in fsm
  * tests: Adjust policy for current sequoia
  * Prevent buffer overruns in findPreambleTag() for language string
  * Fix regression running Lua scripts from non-rpm generated packages
  * Bump rpm-sequoia requirement to >= 1.10.2
  * Prevent command injection in rpmuncompress(1)
  * Add a test for the manual "%add_sysuser m" use
  * Fix typo in add_sysuser ternary
  * Add a test for CVE-2026-44605
  * Harden the ndb implementation against integer overflows
  * Preparing for 6.0.2 release

-- File Changes --

    M CMakeLists.txt (4)
    M build/parsePreamble.cc (12)
    M lib/backend/ndb/rpmidx.c (23)
    M lib/backend/ndb/rpmpkg.c (44)
    M lib/backend/ndb/rpmxdb.c (16)
    M lib/fsm.cc (5)
    M lib/keystore.cc (2)
    M lib/rpmscript.cc (17)
    M macros.in (2)
    M tests/Dockerfile.fedora (2)
    A tests/data/RPMS/mwe-rpm-lua-problem-1.0.0-1.noarch.rpm (0)
    A tests/data/SOURCES/source-singleroot-evil.zip (0)
    A tests/data/SPECS/autosetup-singleroot-evil.spec (13)
    A tests/data/SPECS/preamble-lang.spec (11)
    A tests/data/misc/ndb-corruptor.c (50)
    M tests/pinned/rpmlibver.txt (8)
    M tests/pinned/rpmsigdig.txt (6)
    M tests/pinned/rpmsigdig6.txt (4)
    M tests/rpmbuild.at (9)
    M tests/rpmdb.at (26)
    M tests/rpmi.at (34)
    M tests/rpmsigdig.at (1)
    M tests/rpmspec.at (11)
    M tools/rpmuncompress.cc (4)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/4282.patch
https://github.com/rpm-software-management/rpm/pull/4282.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4282
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/[email protected]>
_______________________________________________
Rpm-maint mailing list
[email protected]
https://lists.rpm.org/mailman/listinfo/rpm-maint

Reply via email to