Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package heroic-games-launcher for
openSUSE:Factory checked in at 2026-07-07 21:00:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/heroic-games-launcher (Old)
and /work/SRC/openSUSE:Factory/.heroic-games-launcher.new.1982 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "heroic-games-launcher"
Tue Jul 7 21:00:39 2026 rev:16 rq:1363798 version:2.22.0
Changes:
--------
---
/work/SRC/openSUSE:Factory/heroic-games-launcher/heroic-games-launcher.changes
2026-06-29 17:34:27.110447435 +0200
+++
/work/SRC/openSUSE:Factory/.heroic-games-launcher.new.1982/heroic-games-launcher.changes
2026-07-07 21:02:21.732545636 +0200
@@ -1,0 +2,14 @@
+Sat Jul 4 00:49:47 UTC 2026 - Jonatas Gonçalves <[email protected]>
+
+- Apply security patches for embedded dependencies:
+ * Add extract-zip-cve-2026-56876.patch to fix path traversal via
+ malicious symlinks (bsc#1269757, CVE-2026-56876).
+ * Add inline sed patches in %build to mitigate electron-updater
+ credential leak (bsc#1269970, CVE-2026-54673).
+ * Add inline sed patches in %build to mitigate app-builder-lib
+ LD_LIBRARY_PATH hijack (bsc#1269968, CVE-2026-54672).
+ * Note: The electron-updater and AppImage vulnerabilities do not
+ affect the native RPM build at runtime, but the embedded code
+ is sanitized to comply with automated security scanners.
+
+-------------------------------------------------------------------
New:
----
extract-zip-cve-2026-56876.patch
----------(New B)----------
New:- Apply security patches for embedded dependencies:
* Add extract-zip-cve-2026-56876.patch to fix path traversal via
malicious symlinks (bsc#1269757, CVE-2026-56876).
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ heroic-games-launcher.spec ++++++
--- /var/tmp/diff_new_pack.nDke7b/_old 2026-07-07 21:02:23.076591617 +0200
+++ /var/tmp/diff_new_pack.nDke7b/_new 2026-07-07 21:02:23.080591753 +0200
@@ -36,6 +36,7 @@
Source1: pnpm-offline-store.tar.gz
Source2: heroic-games-launcher.rpmlintrc
Source3: get-sources.sh
+Source4: extract-zip-cve-2026-56876.patch
BuildRequires: comet
BuildRequires: c++_compiler
BuildRequires: esbuild
@@ -49,6 +50,7 @@
BuildRequires: nodejs-electron-devel
BuildRequires: openssl-devel
BuildRequires: pkgconfig
+BuildRequires: pkgconfig(SPIRV-Tools) >= 2026.2
BuildRequires: pnpm
BuildRequires: protobuf-devel
BuildRequires: vulkan-devel
@@ -77,8 +79,7 @@
Game launcher and manager for GOG, Epic Games, and Amazon
%prep
-%autosetup -n %{name}-%{version}
-%setup -T -D -a1 # pnpm-offline-store
+%autosetup -n %{name}-%{version} -a1
sed -i -e "s/Exec=heroic-run /Exec=heroic /"
flatpak/com.heroicgameslauncher.hgl.desktop
@@ -113,6 +114,18 @@
pnpm config set store-dir .pnpm-store
export PNPM_STORE_DIR=.pnpm-store
pnpm install --offline --store-dir .pnpm-store --frozen-lockfile
--ignore-scripts --strict-peer-dependencies=false
+# Patch to fix CVE-2026-56876
+patch -p1 -d node_modules/.pnpm/[email protected]/node_modules/extract-zip/ <
%{SOURCE4}
+# CVE-2026-54673: electron-updater (builder-util-runtime) Credential Leak
+for file in $(find node_modules/.pnpm -type f -path "*/out/httpExecutor.js"
2>/dev/null); do
+ sed -i 's/delete options.headers.authorization/for(let k of
Object.keys(options.headers)){let
kl=k.toLowerCase();if(kl==="authorization"||kl==="private-token")delete
options.headers[k]}/g' "$file"
+ sed -i 's/delete options.headers\["authorization"\]/for(let k of
Object.keys(options.headers)){let
kl=k.toLowerCase();if(kl==="authorization"||kl==="private-token")delete
options.headers[k]}/g' "$file"
+done
+
+# CVE-2026-54672: app-builder-lib AppRun.sh LD_LIBRARY_PATH Hijack
+for file in $(find node_modules/.pnpm -type f -path
"*/app-builder-lib/templates/linux/AppRun.sh" 2>/dev/null); do
+ sed -i 's/export
LD_LIBRARY_PATH="${APPDIR}\/usr\/lib:${LD_LIBRARY_PATH}"/export
LD_LIBRARY_PATH="${APPDIR}\/usr\/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"/g'
"$file"
+done
pnpm dist:linux %{arch_flag} --dir
%ifarch aarch64
++++++ extract-zip-cve-2026-56876.patch ++++++
diff --git a/index.js b/index.js
index
23384ea16bb848616886f356d8d69f94325535bf..cd34b79f62c1f4fd6d12b5c28d80cccbd46278d9
100644
--- a/index.js
+++ b/index.js
@@ -125,7 +125,19 @@ class Extractor {
const readStream = await
promisify(this.zipfile.openReadStream.bind(this.zipfile))(entry)
if (symlink) {
- const link = await getStream(readStream)
+ let link = await getStream(readStream)
+ link = link.toString().trim()
+
+ // --- CVE-2026-56876 Fix ---
+ const symlinkDir = path.dirname(dest)
+ const absoluteTarget = path.resolve(symlinkDir, link)
+ const safeDir = this.opts.dir
+
+ if (!absoluteTarget.startsWith(safeDir + path.sep) && absoluteTarget !==
safeDir) {
+ throw new Error(`Out of bound symlink target "${absoluteTarget}" found
while processing symlink ${entry.fileName}`)
+ }
+ // --- END OF FIX ---
+
debug('creating symlink', link, dest)
await fs.symlink(link, dest)
} else {
