Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-PyMuPDF for
openSUSE:Leap:16.0 checked in at 2026-09-22 15:11:52
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Leap:16.0/python-PyMuPDF (Old)
and /work/SRC/openSUSE:Leap:16.0/.python-PyMuPDF.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-PyMuPDF"
Tue Sep 22 15:11:52 2026 rev:6 rq: version:1.21.1
Changes:
--------
--- /work/SRC/openSUSE:Leap:16.0/python-PyMuPDF/python-PyMuPDF.changes
2026-06-02 10:49:34.387889020 +0200
+++
/work/SRC/openSUSE:Leap:16.0/.python-PyMuPDF.new.383539/python-PyMuPDF.changes
2026-09-22 15:11:53.412631004 +0200
@@ -1,0 +2,7 @@
+Wed Sep 16 11:42:34 UTC 2026 - Markéta Machová <[email protected]>
+
+- CVE-2026-82035: a path traversal vulnerability in the font branch
+ of extract_objects() in src/__main__.py (bsc#1280486)
+ * CVE-2026-82035.patch
+
+-------------------------------------------------------------------
@@ -5,0 +13 @@
+ * CVE-2026-3029.patch
New:
----
CVE-2026-82035.patch
----------(New B)----------
New: of extract_objects() in src/__main__.py (bsc#1280486)
* CVE-2026-82035.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-PyMuPDF.spec ++++++
--- /var/tmp/diff_new_pack.qjp4sX/_old 2026-09-22 15:11:53.878650489 +0200
+++ /var/tmp/diff_new_pack.qjp4sX/_new 2026-09-22 15:11:53.880650573 +0200
@@ -30,6 +30,8 @@
Source:
https://files.pythonhosted.org/packages/source/P/PyMuPDF/PyMuPDF-%{version}.tar.gz
# PATCH-FIX-UPSTREAM CVE-2026-3029.patch bsc#1259921
Patch0: CVE-2026-3029.patch
+# PATCH-FIX-UPSTREAM CVE-2026-82035.patch bsc#1280486
+Patch1: CVE-2026-82035.patch
BuildRequires: %{python_module devel}
BuildRequires: %{python_module pip}
BuildRequires: %{python_module setuptools}
++++++ CVE-2026-82035.patch ++++++
>From b2c8f3a859fed35c379a44df566f770dc3e18605 Mon Sep 17 00:00:00 2001
From: Julian Smith <[email protected]>
Date: Tue, 8 Sep 2026 10:27:41 +0100
Subject: [PATCH] fitz/__main__.py: extract_objects(): avoid path escape from
directory.
We need to escape '/' and '\' characters.
Fixes https://bugs.ghostscript.com/show_bug.cgi?id=709683.
---
fitz/__main__.py | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
Index: PyMuPDF-1.21.1/fitz/__main__.py
===================================================================
--- PyMuPDF-1.21.1.orig/fitz/__main__.py
+++ PyMuPDF-1.21.1/fitz/__main__.py
@@ -517,8 +517,12 @@ def extract_objects(args):
fontname, ext, _, buffer = doc.extract_font(xref)
if ext == "n/a" or not buffer:
continue
+ name = fontname
+ name = name.replace('/', '-')
+ name = name.replace('\\', '-')
+ name = name.replace(' ', '-')
outname = os.path.join(
- out_dir, f"{fontname.replace(' ', '-')}-{xref}.{ext}"
+ out_dir, f"{name}-{xref}.{ext}"
)
outfile = open(outname, "wb")
outfile.write(buffer)
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.qjp4sX/_old 2026-09-22 15:11:53.936652914 +0200
+++ /var/tmp/diff_new_pack.qjp4sX/_new 2026-09-22 15:11:53.944653249 +0200
@@ -1,7 +1,7 @@
-mtime: 1774019064
-commit: 5e2d23574c29b17095035609e6bc5837a20e967046f289bda5a9c6c58a3fdccb
+mtime: 1789559230
+commit: 1aeddeec836a629a6f0dbe84497af9cce7f8d5bbaeffa68f63972b31e587cc17
url: https://src.opensuse.org/pool/python-PyMuPDF
-revision: 5e2d23574c29b17095035609e6bc5837a20e967046f289bda5a9c6c58a3fdccb
+revision: 1aeddeec836a629a6f0dbe84497af9cce7f8d5bbaeffa68f63972b31e587cc17
trackingbranch: Leap-16.0
projectscmsync: https://src.opensuse.org/openSUSE/Leap
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-09-16 13:47:10.000000000 +0200
@@ -0,0 +1 @@
+.osc
