Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bzip2 for openSUSE:Factory checked in at 2026-08-28 19:47:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bzip2 (Old) and /work/SRC/openSUSE:Factory/.bzip2.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bzip2" Fri Aug 28 19:47:04 2026 rev:70 rq:1373866 version:1.0.8 Changes: -------- --- /work/SRC/openSUSE:Factory/bzip2/bzip2.changes 2023-03-10 22:06:51.700990940 +0100 +++ /work/SRC/openSUSE:Factory/.bzip2.new.1265/bzip2.changes 2026-08-28 19:47:47.064819704 +0200 @@ -1,0 +2,7 @@ +Wed Aug 26 17:37:34 UTC 2026 - Antonio Teixeira <[email protected]> + +- Fix CVE-2026-42250, off‑by‑one error in the bzip2recover utility when + processing a specially crafted file can lead to a crash (bsc#1266786) + * CVE-2026-42250.patch + +------------------------------------------------------------------- New: ---- CVE-2026-42250.patch ----------(New B)---------- New: processing a specially crafted file can lead to a crash (bsc#1266786) * CVE-2026-42250.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bzip2.spec ++++++ --- /var/tmp/diff_new_pack.rOextR/_old 2026-08-28 19:47:48.342864377 +0200 +++ /var/tmp/diff_new_pack.rOextR/_new 2026-08-28 19:47:48.344864447 +0200 @@ -1,7 +1,7 @@ # # spec file for package bzip2 # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -34,6 +34,9 @@ Patch0: bzip2-1.0.6.2-autoconfiscated.patch Patch3: bzip2-point-to-doc-pkg.patch Patch4: bzip2-ocloexec.patch +# PATCH-FIX-UPSTREAM CVE-2026-42250.patch bsc#1266786 [email protected] +# CVE-2026-42250: off‑by‑one error in the bzip2recover utility when processing a specially crafted file can lead to a crash +Patch5: CVE-2026-42250.patch BuildRequires: autoconf >= 2.57 BuildRequires: libtool BuildRequires: pkgconfig ++++++ CVE-2026-42250.patch ++++++ commit 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 Author: Mark Wielaard <[email protected]> Date: Thu May 28 16:15:45 2026 +0200 bzip2recover: Make sure to not process more than BZ_MAX_HANDLED_BLOCKS There is an off-by-one in the check before calling tooManyBlocks. This causes the scanning loop to run one more time and cause a possible read or write one past the global bStart, bEnd, rbStart and rbEnd buffers. There are no known exploits of this issue and you will need to compile with something like gcc -fsanitize=address (ASAN AddressSanitizer) to observe the faulty read/write. This has been assigned CVE-2026-42250. diff --git a/bzip2recover.c b/bzip2recover.c index a8131e0..4b1c219 100644 --- a/bzip2recover.c +++ b/bzip2recover.c @@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv ) rbEnd[rbCtr] = bEnd[currBlock]; rbCtr++; } - if (currBlock >= BZ_MAX_HANDLED_BLOCKS) + if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1) tooManyBlocks(BZ_MAX_HANDLED_BLOCKS); currBlock++;
