Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package aspell for openSUSE:Factory checked in at 2026-10-08 15:13:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/aspell (Old) and /work/SRC/openSUSE:Factory/.aspell.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "aspell" Thu Oct 8 15:13:36 2026 rev:45 rq:1383235 version:0.60.8.2 Changes: -------- --- /work/SRC/openSUSE:Factory/aspell/aspell.changes 2026-06-02 16:01:36.344177581 +0200 +++ /work/SRC/openSUSE:Factory/.aspell.new.3698736/aspell.changes 2026-10-08 15:14:07.013587110 +0200 @@ -1,0 +2,19 @@ +Wed Oct 7 16:31:24 UTC 2026 - Dirk Müller <[email protected]> + +- drop aspell-strict-aliasing.patch (the iterator must remain + a reference, otherwise ++i does not advance it and that + causes an infinte loop) + +------------------------------------------------------------------- +Wed Oct 7 06:29:53 UTC 2026 - Petr Gajdos <[email protected]> + +- added patches + CVE-2026-75818: heap-based buffer overflow in the decompressor in `prog/prezip.c` can lead to memory corruption and process crash [bsc#1284337] + * aspell-CVE-2026-75818.patch + CVE-2026-75819: out-of-bounds read in `ReadOnlyDict::load()` of `readonly_ws.cpp` can lead to heap memory disclosure or application crash [bsc#1284338] + * aspell-CVE-2026-75819.patch + CVE-2026-75820: integer truncation in `WritableDict::add() ` of ` modules/speller/default/writable.cpp` can lead to heap corruption [bsc#1284339] + * aspell-CVE-2026-75820.patch +- SUSE-BSD-Mark-Modifications -> BSD-Mark-Modifications + +------------------------------------------------------------------- Old: ---- aspell-strict-aliasing.patch New: ---- aspell-CVE-2026-75818.patch aspell-CVE-2026-75819.patch aspell-CVE-2026-75820.patch ----------(Old B)---------- Old: - drop aspell-strict-aliasing.patch (the iterator must remain a reference, otherwise ++i does not advance it and that ----------(Old E)---------- ----------(New B)---------- New: CVE-2026-75818: heap-based buffer overflow in the decompressor in `prog/prezip.c` can lead to memory corruption and process crash [bsc#1284337] * aspell-CVE-2026-75818.patch CVE-2026-75819: out-of-bounds read in `ReadOnlyDict::load()` of `readonly_ws.cpp` can lead to heap memory disclosure or application crash [bsc#1284338] New: CVE-2026-75819: out-of-bounds read in `ReadOnlyDict::load()` of `readonly_ws.cpp` can lead to heap memory disclosure or application crash [bsc#1284338] * aspell-CVE-2026-75819.patch CVE-2026-75820: integer truncation in `WritableDict::add() ` of ` modules/speller/default/writable.cpp` can lead to heap corruption [bsc#1284339] New: CVE-2026-75820: integer truncation in `WritableDict::add() ` of ` modules/speller/default/writable.cpp` can lead to heap corruption [bsc#1284339] * aspell-CVE-2026-75820.patch - SUSE-BSD-Mark-Modifications -> BSD-Mark-Modifications ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ aspell.spec ++++++ --- /var/tmp/diff_new_pack.tQ7MBO/_old 2026-10-08 15:14:11.871790696 +0200 +++ /var/tmp/diff_new_pack.tQ7MBO/_new 2026-10-08 15:14:11.873790780 +0200 @@ -20,17 +20,21 @@ Version: 0.60.8.2 Release: 0 Summary: A Spell Checker -License: GFDL-1.1-or-later AND LGPL-2.1-only AND HPND AND SUSE-BSD-Mark-Modifications +License: BSD-Mark-Modifications AND GFDL-1.1-or-later AND LGPL-2.1-only AND HPND Group: Productivity/Text/Spell URL: http://aspell.net/ Source0: https://ftp.gnu.org/gnu/aspell/%{name}-%{version}.tar.gz Source1: https://ftp.gnu.org/gnu/aspell/%{name}-%{version}.tar.gz.sig Source2: %{name}.keyring Source100: baselibs.conf -# PATCH-FIX-OPENSUSE aspell-strict-aliasing.patch [email protected] -- Fix gcc strict aliasing warnings -Patch0: aspell-strict-aliasing.patch # PATCH-FIX-OPENSUSE aspell-quotes.patch [email protected] -- Fix command execution in script "run-with-aspell" Patch1: aspell-quotes.patch +# CVE-2026-75818: heap-based buffer overflow in the decompressor in `prog/prezip.c` can lead to memory corruption and process crash [bsc#1284337] +Patch2: aspell-CVE-2026-75818.patch +# CVE-2026-75820: integer truncation in `WritableDict::add() ` of ` modules/speller/default/writable.cpp` can lead to heap corruption [bsc#1284339] +Patch3: aspell-CVE-2026-75820.patch +# CVE-2026-75819: out-of-bounds read in `ReadOnlyDict::load()` of `readonly_ws.cpp` can lead to heap memory disclosure or application crash [bsc#1284338] +Patch4: aspell-CVE-2026-75819.patch BuildRequires: fdupes BuildRequires: gcc-c++ BuildRequires: libtool @@ -121,7 +125,7 @@ %build autoreconf -fiv -export CXXFLAGS="%{optflags} `ncursesw6-config --cflags`" +export CXXFLAGS="%{optflags} -Werror=strict-aliasing `ncursesw6-config --cflags`" #this is an ugly kludge , don't look :-) export LDFLAGS="`ncursesw6-config --libs`" %configure \ ++++++ aspell-CVE-2026-75818.patch ++++++ >From 15b188437f9e0192d4ac4472ad66a4e2f62a782f Mon Sep 17 00:00:00 2001 From: Kevin Atkinson <[email protected]> Date: Sun, 20 Sep 2026 23:09:03 -0400 Subject: [PATCH] prezip: correctly detect bad input MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-75818 identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. --- prog/prezip.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/prog/prezip.c b/prog/prezip.c index 3835114a..bbd0772f 100644 --- a/prog/prezip.c +++ b/prog/prezip.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2004 + * Copyright (c) 2004,2026 * Kevin Atkinson * * Permission to use, copy, modify, distribute and sell this software @@ -47,7 +47,7 @@ #endif -#define HEAD "prezip, a prefix delta compressor. Version 0.1.1, 2004-11-06" +#define HEAD "prezip, a prefix delta compressor. Version 0.1.2, 2026-09-20" typedef struct Word { char * str; @@ -65,7 +65,7 @@ typedef struct Word { #define ADV(w, c) do {char * s = w + c;\ while(w != s) {\ - if (*w == 0) ret = 3;\ + if (*w == 0) {ret = 3; goto error;}\ ++w;}} while (0) int main (int argc, const char *argv[]) { @@ -227,6 +227,7 @@ int main (int argc, const char *argv[]) { assert(ret >= 0); if (ret > 0 && argc > 2) fputs(argv[2], stderr); + error: if (ret == 2) fputs("unknown format\n", stderr); else if (ret == 3) ++++++ aspell-CVE-2026-75819.patch ++++++ >From 941953b25031bc9104e83f58e138a664b8dedc3f Mon Sep 17 00:00:00 2001 From: Kevin Atkinson <[email protected]> Date: Mon, 21 Sep 2026 22:53:56 -0400 Subject: [PATCH] speller/readonly_ws.cpp: check that offsets are valid in dictionary header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-75819 identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. --- modules/speller/default/readonly_ws.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) Index: aspell-0.60.8.2/modules/speller/default/readonly_ws.cpp =================================================================== --- aspell-0.60.8.2.orig/modules/speller/default/readonly_ws.cpp +++ aspell-0.60.8.2/modules/speller/default/readonly_ws.cpp @@ -476,6 +476,15 @@ namespace { block_size = data_head.block_size; int offset = data_head.head_size; + + if (data_head.word_offset > block_size + || data_head.hash_offset > block_size + || data_head.jump1_offset > block_size + || data_head.jump2_offset > block_size + || data_head.word_offset + data_head.first_word_offset > block_size) + return make_err(bad_file_format, fn, + _("Invalid offset in dictionary header.")); + mmaped_block = mmap_open(block_size + offset, f, 0); if( mmaped_block != (char *)MAP_FAILED) { block = mmaped_block + offset; ++++++ aspell-CVE-2026-75820.patch ++++++ >From 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d Mon Sep 17 00:00:00 2001 From: Kevin Atkinson <[email protected]> Date: Mon, 21 Sep 2026 01:05:16 -0400 Subject: [PATCH] Limit length of words added to the personal dictionary to 250 characters. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-75820 identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. --- modules/speller/default/writable.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/speller/default/writable.cpp b/modules/speller/default/writable.cpp index 63172a48..b3b2990e 100644 --- a/modules/speller/default/writable.cpp +++ b/modules/speller/default/writable.cpp @@ -16,6 +16,8 @@ #include "language.hpp" #include "getdata.hpp" +#include "gettext.h" + namespace { ////////////////////////////////////////////////////////////////////// @@ -511,10 +513,14 @@ PosibErr<void> WritableDict::add(ParmString w, ParmString s) { SensitiveCompare c(lang()); WordEntry we; if (WritableDict::lookup(w,&c,we)) return no_err; + if (w.size() > 250) + return make_err(invalid_word, + MsgConv(*lang())(w), + _("Word larger than 250 characters.")); byte * w2; w2 = (byte *)buffer.alloc(w.size() + 3); *w2++ = lang()->get_word_info(w); - *w2++ = w.size(); + *w2++ = (byte)w.size(); memcpy(w2, w.str(), w.size() + 1); word_lookup->insert((char *)w2); if (use_soundslike) {
