Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mupdf for openSUSE:Factory checked in at 2026-11-13 18:31:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mupdf (Old) and /work/SRC/openSUSE:Factory/.mupdf.new.1251 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mupdf" Fri Nov 13 18:31:35 2026 rev:85 rq:1397047 version:1.28.6 Changes: -------- --- /work/SRC/openSUSE:Factory/mupdf/mupdf.changes 2026-11-09 16:04:51.315344857 +0100 +++ /work/SRC/openSUSE:Factory/.mupdf.new.1251/mupdf.changes 2026-11-13 18:35:33.252865947 +0100 @@ -1,0 +2,9 @@ +Thu Nov 12 08:56:45 UTC 2026 - Martin Pluskal <[email protected]> + +- CVE-2026-110715: bundled mujs Array.prototype.sort heap + out-of-bounds read/write via inflated array length (boo#1285755) + The shipped thirdparty/mujs snapshot is verbatim upstream mujs + 1.3.10, which already carries the fix; correct the stale + bundled(mujs) = 1.3.8 Provides to 1.3.10. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mupdf.spec ++++++ --- /var/tmp/diff_new_pack.E841A7/_old 2026-11-13 18:35:35.073943048 +0100 +++ /var/tmp/diff_new_pack.E841A7/_new 2026-11-13 18:35:35.075943132 +0100 @@ -74,7 +74,9 @@ Provides: bundled(gumbo-parser) = 0.10.1 Provides: bundled(lcms2) = 2.19 Provides: bundled(lcms2-art) = 2.19 -Provides: bundled(mujs) = 1.3.8 +# bundled mujs is verbatim upstream 1.3.10 (sort OOB fixed); +# 1.3.11-only hardening, e.g. the jsR_isindex guard, is missing +Provides: bundled(mujs) = 1.3.10 %description MuPDF is a PDF and XPS viewer and parser/rendering library.
