Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rpcbind for openSUSE:Factory checked in at 2026-09-08 16:53:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rpcbind (Old) and /work/SRC/openSUSE:Factory/.rpcbind.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rpcbind" Tue Sep 8 16:53:03 2026 rev:74 rq:1375903 version:1.2.9 Changes: -------- --- /work/SRC/openSUSE:Factory/rpcbind/rpcbind.changes 2026-06-02 16:01:23.623649943 +0200 +++ /work/SRC/openSUSE:Factory/.rpcbind.new.1265/rpcbind.changes 2026-09-08 16:53:35.547644206 +0200 @@ -1,0 +2,7 @@ +Mon Aug 31 12:00:00 UTC 2026 - Thomas Blume <[email protected]> + +- Fix stack-based buffer overflow in rpcinfo's rpcbdump() + short-mode version-list formatting (bsc#1272340, CVE-2026-16461) + * add 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch + +------------------------------------------------------------------- New: ---- 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch ----------(New B)---------- New: short-mode version-list formatting (bsc#1272340, CVE-2026-16461) * add 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rpcbind.spec ++++++ --- /var/tmp/diff_new_pack.5eHJ6e/_old 2026-09-08 16:53:36.269674497 +0200 +++ /var/tmp/diff_new_pack.5eHJ6e/_new 2026-09-08 16:53:36.270674539 +0200 @@ -1,8 +1,7 @@ # # spec file for package rpcbind # -# Copyright (c) 2026 SUSE LLC -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -32,6 +31,7 @@ Source: https://downloads.sourceforge.net/sourceforge/%{name}/%{name}-%{version}.tar.bz2 Source2: sysconfig.rpcbind Source5: rpc-user.conf +Patch: 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch BuildRequires: libtirpc-devel >= 1.0.1 BuildRequires: libtool BuildRequires: pkgconfig ++++++ 0001-rpcinfo-fix-stack-buffer-overflow-in-rpcbdump-short-.patch ++++++ >From ede9c54c0040d06d89683c2a8dd29b5a59a10264 Mon Sep 17 00:00:00 2001 From: Thomas Blume <[email protected]> Date: Mon, 31 Aug 2026 12:09:24 +0000 Subject: [PATCH] rpcinfo: fix stack buffer overflow in rpcbdump() short-mode (CVE-2026-16461) --- src/rpcinfo.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/rpcinfo.c b/src/rpcinfo.c index 30d535e..c63d8d0 100644 --- a/src/rpcinfo.c +++ b/src/rpcinfo.c @@ -959,14 +959,23 @@ rpcbdump ( { size_t netidmax = sizeof(buf) - 1; char *p = buf; + size_t rem = sizeof(buf); + int n; + buf[0] = '\0'; printf ("%10ld ", rs->prog); for (vl = rs->vlist; vl; vl = vl->next) { - sprintf (p, "%d", vl->vers); - p = p + strlen (p); - if (vl->next) - sprintf (p++, ","); + n = snprintf(p, rem, "%d%s", vl->vers, vl->next ? "," : ""); + if (n < 0) + break; + if ((size_t)n >= rem) + { + p = buf + sizeof(buf) - 1; + break; + } + p += n; + rem -= (size_t)n; } printf ("%-10s", buf); buf[0] = '\0'; -- 2.55.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.5eHJ6e/_old 2026-09-08 16:53:36.320676637 +0200 +++ /var/tmp/diff_new_pack.5eHJ6e/_new 2026-09-08 16:53:36.324676805 +0200 @@ -1,5 +1,5 @@ <services> -<service name="download_files" mode="localonly"> +<service name="download_files" mode="manual"> <param name="enforceupstream">yes</param> </service> </services>
