Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package vsftpd for openSUSE:Factory checked in at 2026-11-08 19:21:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/vsftpd (Old) and /work/SRC/openSUSE:Factory/.vsftpd.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "vsftpd" Sun Nov 8 19:21:27 2026 rev:95 rq:1395875 version:3.0.5 Changes: -------- --- /work/SRC/openSUSE:Factory/vsftpd/vsftpd.changes 2026-09-30 16:23:03.775377424 +0200 +++ /work/SRC/openSUSE:Factory/.vsftpd.new.3759290/vsftpd.changes 2026-11-08 19:21:45.592320276 +0100 @@ -1,0 +2,8 @@ +Fri Nov 6 14:30:08 UTC 2026 - Peter Simons <[email protected]> + +- Update vsftpd-2.3.4-sqb.patch to use unsigned character range + bounds and stop expansion when the counter wraps to zero, + preventing a denial of service in LIST pattern matching. + [CVE-2025-14242, bsc#1256700] + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ vsftpd.spec ++++++ --- /var/tmp/diff_new_pack.J8Px8P/_old 2026-11-08 19:21:46.992378193 +0100 +++ /var/tmp/diff_new_pack.J8Px8P/_new 2026-11-08 19:21:46.995378317 +0100 @@ -1,7 +1,7 @@ # # spec file for package vsftpd # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -30,7 +30,7 @@ Version: 3.0.5 Release: 0 Summary: Very Secure FTP Daemon - Written from Scratch -License: SUSE-GPL-2.0-with-openssl-exception +License: LicenseRef-SUSE-GPL-2.0-with-openssl-exception Group: Productivity/Networking/Ftp/Servers URL: https://security.appspot.com/vsftpd.html Source0: https://security.appspot.com/downloads/%{name}-%{version}.tar.gz ++++++ vsftpd-2.3.4-sqb.patch ++++++ --- /var/tmp/diff_new_pack.J8Px8P/_old 2026-11-08 19:21:47.095382454 +0100 +++ /var/tmp/diff_new_pack.J8Px8P/_new 2026-11-08 19:21:47.100382661 +0100 @@ -76,7 +76,7 @@ + if (end_sqb.found) + { + unsigned int cur_pos; -+ char stch, ench; ++ unsigned char stch, ench; + const char *p_brace; + + str_split_char(&filter_remain_str, &temp_str, ']'); @@ -99,7 +99,7 @@ + cur_pos++; + } + // expand char[s] -+ for (;stch <= ench && !str_isempty(&brace_list_str); stch++) ++ for (;stch <= ench && !str_isempty(&brace_list_str) && stch != 0; stch++) + { + str_empty(&new_filter_str); + if (!matched)
