Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gd for openSUSE:Factory checked in at 2026-08-02 23:13:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gd (Old) and /work/SRC/openSUSE:Factory/.gd.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gd" Sun Aug 2 23:13:13 2026 rev:60 rq:1368829 version:2.3.3 Changes: -------- --- /work/SRC/openSUSE:Factory/gd/gd.changes 2024-02-23 16:40:59.745911478 +0100 +++ /work/SRC/openSUSE:Factory/.gd.new.16738/gd.changes 2026-08-02 23:13:38.646667817 +0200 @@ -1,0 +2,7 @@ +Fri Jul 31 10:50:47 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-9672: upgrade gd [bsc#1273101] + * gd-CVE-2026-9672.patch + +------------------------------------------------------------------- New: ---- gd-CVE-2026-9672.patch ----------(New B)---------- New: CVE-2026-9672: upgrade gd [bsc#1273101] * gd-CVE-2026-9672.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gd.spec ++++++ --- /var/tmp/diff_new_pack.YGguA7/_old 2026-08-02 23:13:39.442695198 +0200 +++ /var/tmp/diff_new_pack.YGguA7/_new 2026-08-02 23:13:39.442695198 +0200 @@ -1,7 +1,7 @@ # # spec file for package gd # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -34,6 +34,8 @@ Patch2: gd-format.patch # could be upstreamed Patch3: gd-aliasing.patch +# CVE-2026-9672: upgrade gd [bsc#1273101] +Patch4: gd-CVE-2026-9672.patch # needed for tests BuildRequires: dejavu-fonts BuildRequires: libjpeg-devel ++++++ gd-CVE-2026-9672.patch ++++++ Index: src/gd_gif_in.c =================================================================== --- src/gd_gif_in.c.orig +++ src/gd_gif_in.c @@ -530,7 +530,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DAT } for(; i < (1 << MAX_LWZ_BITS); ++i) { - sd->table[0][i] = sd->table[1][0] = 0; + sd->table[0][i] = sd->table[1][i] = 0; } sd->sp = sd->stack; @@ -577,6 +577,8 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DAT if(*ZeroDataBlockP) { return -2; + + return -2; } while((count = GetDataBlock(fd, buf, ZeroDataBlockP)) > 0); @@ -664,7 +666,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, in unsigned char c; int xpos = 0, ypos = 0, pass = 0; int v, i; - LZW_STATIC_DATA sd; + LZW_STATIC_DATA sd = {0}; /* Initialize the Compression routines */ if(!ReadOK(fd, &c, 1)) {
