Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package glibc for openSUSE:Factory checked in at 2026-11-13 18:24:59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/glibc (Old) and /work/SRC/openSUSE:Factory/.glibc.new.1251 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "glibc" Fri Nov 13 18:24:59 2026 rev:310 rq:1396498 version:2.44 Changes: -------- --- /work/SRC/openSUSE:Factory/glibc/glibc.changes 2026-10-07 19:31:34.883075495 +0200 +++ /work/SRC/openSUSE:Factory/.glibc.new.1251/glibc.changes 2026-11-13 18:25:01.967139400 +0100 @@ -1,0 +2,6 @@ +Wed Nov 4 11:40:42 UTC 2026 - Andreas Schwab <[email protected]> + +- intl-restrict-path-traversal.patch: intl: Restrict path traversal when + using LANGUAGE env var (CVE-2026-84243, bsc#1289299, BZ #17142) + +------------------------------------------------------------------- New: ---- intl-restrict-path-traversal.patch ----------(New B)---------- New: - intl-restrict-path-traversal.patch: intl: Restrict path traversal when using LANGUAGE env var (CVE-2026-84243, bsc#1289299, BZ #17142) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ glibc.spec ++++++ --- /var/tmp/diff_new_pack.ryAW3H/_old 2026-11-13 18:25:04.247235927 +0100 +++ /var/tmp/diff_new_pack.ryAW3H/_new 2026-11-13 18:25:04.249236012 +0100 @@ -369,6 +369,8 @@ Patch1020: power8-strncasecmp-overread.patch # PATCH-FIX-UPSTREAM realloc: Fix mmap non-mremap reallocation case (BZ #34697) Patch1021: realloc-mmap-non-mremap.patch +# PATCH-FIX-UPSTREAM intl: Restrict path traversal when using LANGUAGE env var (CVE-2026-84243, BZ #17142) +Patch1022: intl-restrict-path-traversal.patch %endif ### ++++++ intl-restrict-path-traversal.patch ++++++ >From be6168cd101bf451df4a59afbf0c02f8778c3478 Mon Sep 17 00:00:00 2001 From: Avinal Kumar <[email protected]> Date: Mon, 2 Nov 2026 17:18:03 -0300 Subject: [PATCH] intl: Restrict path traversal when using LANGUAGE env var [BZ #17142, CVE-2026-84243] The fix for CVE-2014-0475 (Bug 17137) added valid_locale_name() in locale/findlocale.c to reject locale names containing ".." path components. However, the LANGUAGE environment variable processing in intl/dcigettext.c was not covered by that fix. An attacker who can set LANGUAGE (e.g. via SSH AcceptEnv) can force any gettext-using program to load a crafted .mo file from an arbitrary filesystem location via directory traversal. A crafted .mo file can crash the program through out-of-range offsets or through format-string translations that consume more arguments than the caller passes, causing undefined behaviour in *printf. glibc cannot fully protect against the latter at the gettext level. The safety of .mo files normally relies on them being produced by msgmerge and msgfmt -c and installed in read-only locations; path traversal bypasses this trust model. Remove the ENABLE_SECURE gate from the IS_PATH_WITH_DIR check so it applies to all binaries, not just SUID/SGID ones, and extend it to also reject the bare ".." entry which contains no directory separator but still names the parent directory. Add tst-gettext-path-traversal to verify that locale names containing path separators or equal to ".." are rejected by the LANGUAGE processing loop. This fixes bug 17142 and CVE-2026-84243. Suggested-by: Adhemerval Zanella <[email protected]> Signed-off-by: Avinal Kumar <[email protected]> Reviewed-by: Adhemerval Zanella <[email protected]> --- intl/Makefile | 4 ++ intl/dcigettext.c | 8 +-- intl/tst-gettext-path-traversal.c | 83 +++++++++++++++++++++++++++++++ 3 files changed, 91 insertions(+), 4 deletions(-) create mode 100644 intl/tst-gettext-path-traversal.c diff --git a/intl/Makefile b/intl/Makefile index a8b41a1993..2547de2744 100644 --- a/intl/Makefile +++ b/intl/Makefile @@ -61,6 +61,7 @@ $(objpfx)plural.o: $(objpfx)plural.c ifeq ($(run-built-tests),yes) ifeq (yes,$(build-shared)) ifneq ($(strip $(MSGFMT)),:) +tests += tst-gettext-path-traversal tests-special += \ $(objpfx)tst-translit.out \ $(objpfx)tst-gettext.out \ @@ -125,6 +126,7 @@ $(objpfx)tst-plural-eval.out: tst-plural-eval.sh $(objpfx)tst-plural-eval $(objpfx)tst-codeset.out: $(codeset_mo) $(objpfx)tst-gettext3.out: $(codeset_mo) $(objpfx)tst-gettext5.out: $(codeset_mo) +$(objpfx)tst-gettext-path-traversal.out: $(codeset_mo) endif LOCALES := de_DE.ISO-8859-1 de_DE.UTF-8 en_US.ANSI_X3.4-1968 fr_FR.ISO-8859-1 \ @@ -139,6 +141,7 @@ $(objpfx)tst-gettext4.out: $(gen-locales) $(objpfx)tst-gettext5.out: $(gen-locales) $(objpfx)tst-gettext6.out: $(gen-locales) $(objpfx)tst-gettext-c-utf8.out: $(gen-locales) +$(objpfx)tst-gettext-path-traversal.out: $(gen-locales) $(objpfx)tst-translit.out: $(gen-locales) endif @@ -159,6 +162,7 @@ CFLAGS-tst-gettext4.c += -DOBJPFX=\"$(objpfx)\" CFLAGS-tst-gettext5.c += -DOBJPFX=\"$(objpfx)\" CFLAGS-tst-gettext6.c += -DOBJPFX=\"$(objpfx)\" CFLAGS-tst-plural-eval.c += -DOBJPFX=\"$(objpfx)\" +CFLAGS-tst-gettext-path-traversal.c += -DOBJPFX=\"$(objpfx)\" ifeq ($(have-thread-library),yes) ifeq (yes,$(build-shared)) diff --git a/intl/dcigettext.c b/intl/dcigettext.c index 43b99c2dea..e9611dae7a 100644 --- a/intl/dcigettext.c +++ b/intl/dcigettext.c @@ -591,10 +591,10 @@ DCIGETTEXT (const char *domainname, const char *msgid1, const char *msgid2, *cp++ = *categoryvalue++; *cp = '\0'; - /* When this is a SUID binary we must not allow accessing files - outside the dedicated directories. */ - if (ENABLE_SECURE && IS_PATH_WITH_DIR (single_locale)) - /* Ignore this entry. */ + /* Do not allow accessing files outside the dedicated + directories. */ + if (IS_PATH_WITH_DIR (single_locale) + || strcmp (single_locale, "..") == 0) continue; } diff --git a/intl/tst-gettext-path-traversal.c b/intl/tst-gettext-path-traversal.c new file mode 100644 index 0000000000..95ad326f64 --- /dev/null +++ b/intl/tst-gettext-path-traversal.c @@ -0,0 +1,83 @@ +/* Test that LANGUAGE values with path traversal are rejected [BZ #17142]. + Copyright (C) 2026 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + <https://www.gnu.org/licenses/>. */ + +#include <libintl.h> +#include <locale.h> +#include <stdlib.h> +#include <support/check.h> +#include <support/support.h> + +static const char *const domaindir = OBJPFX "domaindir"; +static const char *const localedir = OBJPFX "domaindir/de_DE"; +static const char *const msgdir = OBJPFX "domaindir/de_DE/LC_MESSAGES"; + +static int +do_test (void) +{ + unsetenv ("OUTPUT_CHARSET"); + /* LANGUAGE is only consulted if the locale is not "C" or "C.<codeset>". + The catalog is in ISO-8859-1, as is the locale, so no conversion of + the translation takes place. */ + xsetlocale (LC_ALL, "de_DE.ISO-8859-1"); + textdomain ("codeset"); + + /* Verify that a legitimate LANGUAGE value produces the expected + translation. This exercises the normal lookup path and confirms + that the test .mo catalog is in place. */ + bindtextdomain ("codeset", domaindir); + setenv ("LANGUAGE", "de_DE", 1); + TEST_COMPARE_STRING (gettext ("cheese"), "K\344se"); + + /* A bare ".." must be rejected. Without the fix this would resolve + to msgdir/../LC_MESSAGES/codeset.mo, which is the real catalog, + so the translation would succeed. */ + bindtextdomain ("codeset", msgdir); + setenv ("LANGUAGE", "..", 1); + TEST_COMPARE_STRING (gettext ("cheese"), "cheese"); + + /* A relative path that leaves and re-enters the catalog directory + must be rejected. Without the fix this would resolve to + localedir/../de_DE/LC_MESSAGES/codeset.mo. */ + bindtextdomain ("codeset", localedir); + setenv ("LANGUAGE", "../de_DE", 1); + TEST_COMPARE_STRING (gettext ("cheese"), "cheese"); + + /* Multiple levels of directory traversal must be rejected. Without + the fix this would resolve to + msgdir/../../de_DE/LC_MESSAGES/codeset.mo. */ + bindtextdomain ("codeset", msgdir); + setenv ("LANGUAGE", "../../de_DE", 1); + TEST_COMPARE_STRING (gettext ("cheese"), "cheese"); + + /* Invalid entries in a colon-separated LANGUAGE list must be + skipped individually; valid entries that follow are still + used. */ + bindtextdomain ("codeset", domaindir); + setenv ("LANGUAGE", "..:../de_DE:de_DE", 1); + TEST_COMPARE_STRING (gettext ("cheese"), "K\344se"); + + /* A path containing "/.." must be rejected. Use localedir so the + binding changes, which invalidates the DCIGETTEXT result cache. */ + bindtextdomain ("codeset", localedir); + setenv ("LANGUAGE", "LC_MESSAGES/..", 1); + TEST_COMPARE_STRING (gettext ("cheese"), "cheese"); + + return 0; +} + +#include <support/test-driver.c> -- 2.56.0
