From 597d7b6093487940f2cd47aa0a5a87b36dab4704 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Mon, 7 Sep 2026 15:07:34 +0000 Subject: [PATCH] Patch gdk-pixbuf2 for CVE-2026-81893 --- SPECS/gdk-pixbuf2/CVE-2026-81893.patch | 36 ++++++++++++++++++++++++++ SPECS/gdk-pixbuf2/gdk-pixbuf2.spec | 6 ++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 SPECS/gdk-pixbuf2/CVE-2026-81893.patch diff --git a/SPECS/gdk-pixbuf2/CVE-2026-81893.patch b/SPECS/gdk-pixbuf2/CVE-2026-81893.patch new file mode 100644 index 00000000000..9d4aafb5246 --- /dev/null +++ b/SPECS/gdk-pixbuf2/CVE-2026-81893.patch @@ -0,0 +1,36 @@ +From adcf6af8bdfe57da8955784eb2ef7e1a66201fe3 Mon Sep 17 00:00:00 2001 +From: Benjamin Otte +Date: Wed, 5 Aug 2026 18:19:01 +0200 +Subject: [PATCH] jpeg: When freeing memory, unset the size + +Fixes potential invalid write if a specifically crafted JPEG file +would use markers to: + +1. cause memory to be allocated +2. cause it to be freed due to an error +3. cause memory to be allocated again + +I did not attempt to craft such a file. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658674bd103d1c9bf50809d5767a3f6dd5a01.patch +--- + gdk-pixbuf/io-jpeg.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c +index 60ad0d0..767546e 100644 +--- a/gdk-pixbuf/io-jpeg.c ++++ b/gdk-pixbuf/io-jpeg.c +@@ -386,6 +386,8 @@ out: + if (!ret) { + g_free (context->icc_profile); + context->icc_profile = NULL; ++ context->icc_profile_size = 0; ++ context->icc_profile_size_allocated = 0; + } + return ret; + } +-- +2.45.4 + diff --git a/SPECS/gdk-pixbuf2/gdk-pixbuf2.spec b/SPECS/gdk-pixbuf2/gdk-pixbuf2.spec index 8bb1a9f9d5f..a94e6bfa140 100644 --- a/SPECS/gdk-pixbuf2/gdk-pixbuf2.spec +++ b/SPECS/gdk-pixbuf2/gdk-pixbuf2.spec @@ -2,7 +2,7 @@ Summary: An image loading library Name: gdk-pixbuf2 Version: 2.42.10 -Release: 5%{?dist} +Release: 6%{?dist} License: LGPLv2+ Vendor: Microsoft Corporation Distribution: Azure Linux @@ -12,6 +12,7 @@ Patch0: CVE-2022-48622.patch Patch1: CVE-2025-6199.patch Patch2: CVE-2025-7345.patch Patch3: CVE-2026-5201.patch +Patch4: CVE-2026-81893.patch BuildRequires: %{_bindir}/rst2man BuildRequires: gettext BuildRequires: libjpeg-devel @@ -118,6 +119,9 @@ gdk-pixbuf-query-loaders-%{__isa_bits} --update-cache %{_datadir}/installed-tests %changelog +* Mon Sep 07 2026 Azure Linux Security Servicing Account - 2.42.10-6 +- Patch for CVE-2026-81893 + * Thu Apr 02 2026 Azure Linux Security Servicing Account - 2.42.10-5 - Patch for CVE-2026-5201