Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package gd for openSUSE:Factory checked in 
at 2026-08-02 23:13:13
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/gd (Old)
 and      /work/SRC/openSUSE:Factory/.gd.new.16738 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "gd"

Sun Aug  2 23:13:13 2026 rev:60 rq:1368829 version:2.3.3

Changes:
--------
--- /work/SRC/openSUSE:Factory/gd/gd.changes    2024-02-23 16:40:59.745911478 
+0100
+++ /work/SRC/openSUSE:Factory/.gd.new.16738/gd.changes 2026-08-02 
23:13:38.646667817 +0200
@@ -1,0 +2,7 @@
+Fri Jul 31 10:50:47 UTC 2026 - Petr Gajdos <[email protected]>
+
+- added patches
+  CVE-2026-9672: upgrade gd [bsc#1273101]
+  * gd-CVE-2026-9672.patch
+
+-------------------------------------------------------------------

New:
----
  gd-CVE-2026-9672.patch

----------(New B)----------
  New:  CVE-2026-9672: upgrade gd [bsc#1273101]
  * gd-CVE-2026-9672.patch
----------(New E)----------

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ gd.spec ++++++
--- /var/tmp/diff_new_pack.YGguA7/_old  2026-08-02 23:13:39.442695198 +0200
+++ /var/tmp/diff_new_pack.YGguA7/_new  2026-08-02 23:13:39.442695198 +0200
@@ -1,7 +1,7 @@
 #
 # spec file for package gd
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -34,6 +34,8 @@
 Patch2:         gd-format.patch
 # could be upstreamed
 Patch3:         gd-aliasing.patch
+# CVE-2026-9672: upgrade gd [bsc#1273101]
+Patch4:         gd-CVE-2026-9672.patch
 # needed for tests
 BuildRequires:  dejavu-fonts
 BuildRequires:  libjpeg-devel

++++++ gd-CVE-2026-9672.patch ++++++
Index: src/gd_gif_in.c
===================================================================
--- src/gd_gif_in.c.orig
+++ src/gd_gif_in.c
@@ -530,7 +530,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DAT
                }
 
                for(; i < (1 << MAX_LWZ_BITS); ++i) {
-                       sd->table[0][i] = sd->table[1][0] = 0;
+                       sd->table[0][i] = sd->table[1][i] = 0;
                }
 
                sd->sp = sd->stack;
@@ -577,6 +577,8 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DAT
 
                        if(*ZeroDataBlockP) {
                                return -2;
+
+                       return -2;
                        }
 
                        while((count = GetDataBlock(fd, buf, ZeroDataBlockP)) > 
0);
@@ -664,7 +666,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, in
        unsigned char c;
        int xpos = 0, ypos = 0, pass = 0;
        int v, i;
-       LZW_STATIC_DATA sd;
+       LZW_STATIC_DATA sd = {0};
 
        /* Initialize the Compression routines */
        if(!ReadOK(fd, &c, 1)) {

Reply via email to