[rpms/gzip] main: Fix CVE-2026-41911

[rpms/gzip] main: Fix CVE-2026-41911

[Jakub Martisko]

A new commit has been pushed.

Repo   : rpms/gzip
Branch : main
Commit : 8a1d06a0784597cdce2a24c35512012ef2365dd7
Author : Jakub Martisko <jamartis@redhat.com>
Date   : 2026-07-13T13:49:55+02:00
Stats  : +60/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/gzip/c/8a1d06a0784597cdce2a24c35512012ef2365dd7?branch=main

Log:
Fix CVE-2026-41911

---
diff --git a/CVE-2026-41911.patch b/CVE-2026-41911.patch
new file mode 100644
index 0000000..2024cb0
--- /dev/null
+++ b/CVE-2026-41911.patch
@@ -0,0 +1,54 @@
+From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 16 Apr 2026 12:11:44 -0700
+Subject: gzexe: use -C if lacking mktemp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(Problem reported by Michał Majchrowicz.)
+* gzexe.in: If mktemp is needed but not installed,
+use ‘set -C’ to avoid a race when creating a temporary file.
+* zdiff.in: Use the same pattern here, even though the old
+code was probably OK anyway.
+---
+ NEWS     | 5 +++++
+ gzexe.in | 1 +
+ zdiff.in | 7 +++----
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/gzexe.in b/gzexe.in
+index ea4ef94..f3d46cc 100644
+--- a/gzexe.in
++++ b/gzexe.in
+@@ -127,6 +127,7 @@ for i do
+     tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
+   else
+     tmp=${dir}gzexe$$
++    (umask 77; set -C; > "$tmp")
+   fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
+     res=$?
+     printf >&2 '%s\n' "$0: cannot copy $file"
+diff --git a/zdiff.in b/zdiff.in
+index 289e466..53266df 100644
+--- a/zdiff.in
++++ b/zdiff.in
+@@ -156,12 +156,11 @@ case $file2 in
+                           *) TMPDIR=/tmp/;;
+                         esac
+                         if command -v mktemp >/dev/null 2>&1; then
+-                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
+-                            exit 2
++                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
+                         else
+-                          set -C
+                           tmp=${TMPDIR}zdiff$$
+-                        fi
++                          (umask 77; set -C; > "$tmp")
++                        fi &&
+                         'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
+                         gzip_status=$(
+                           exec 4>&1
+-- 
+cgit v1.2.3
+

diff --git a/gzip.spec b/gzip.spec
index de391de..5034273 100644
--- a/gzip.spec
+++ b/gzip.spec
@@ -1,7 +1,7 @@
 Summary: GNU data compression program
 Name: gzip
 Version: 1.14
-Release: 2%{?dist}
+Release: 3%{?dist}
 # info pages are under GFDL license
 License: GPL-3.0-or-later AND GFDL-1.3-only
 Source0: https://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
@@ -12,6 +12,7 @@ Source100: colorzgrep.csh
 Source101: colorzgrep.sh
 
 Patch1: s390_errno.patch
+Patch2: CVE-2026-41911.patch
 
 # Fixed in upstream code.
 # http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378
@@ -40,6 +41,7 @@ very commonly used data compression program.
 %prep
 %setup -q
 %patch 1 -p1
+%patch 2 -p1
 
 cp %{SOURCE1} .
 autoreconf
@@ -91,6 +93,9 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir}
 %{profiledir}/*
 
 %changelog
+* Mon Jul 13 2026 Jakub Martisko <jamartis@redhat.com> - 1.14-3
+- Fix CVE-2026-41911
+
 * Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.14-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild