public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Filipe Rosset <rosset.filipe@gmail.com>
To: git-commits@fedoraproject.org
Subject: [rpms/libXpm] rawhide: update to 3.5.19 fixes CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
Date: Mon, 27 Jul 2026 06:06:06 GMT [thread overview]
Message-ID: <178513236640.1.5738580296919448024.rpms-libXpm-1be01b2df08a@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/libXpm
Branch : rawhide
Commit : 1be01b2df08a2c94215a5cf3ab4315e3e20f5857
Author : Filipe Rosset <rosset.filipe@gmail.com>
Date : 2026-07-25T18:18:55-03:00
Stats : +31/-19 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/libXpm/c/1be01b2df08a2c94215a5cf3ab4315e3e20f5857?branch=rawhide
Log:
update to 3.5.19 fixes CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
---
diff --git a/.gitignore b/.gitignore
index ae8a25d..a9f6b71 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,3 @@
/libXpm-*.tar.xz
+/libXpm-3.5.19.tar.xz.sig
+/gpgkey-67DC86F2623FC5FD4BB5225D14706DBE1E4B4540.gpg
diff --git a/libXpm.spec b/libXpm.spec
index a89b96a..c8a6622 100644
--- a/libXpm.spec
+++ b/libXpm.spec
@@ -1,49 +1,56 @@
Summary: X.Org X11 libXpm runtime library
Name: libXpm
-Version: 3.5.17
+Version: 3.5.19
Release: %autorelease
License: MIT AND X11-distribute-modifications-variant
-URL: http://www.x.org
+URL: https://www.x.org
Source0: https://www.x.org/pub/individual/lib/%{name}-%{version}.tar.xz
+Source1: https://www.x.org/pub/individual/lib/%{name}-%{version}.tar.xz.sig
+Source2: gpgkey-67DC86F2623FC5FD4BB5225D14706DBE1E4B4540.gpg
-BuildRequires: xorg-x11-util-macros
-BuildRequires: autoconf automake libtool make
+BuildRequires: gcc
BuildRequires: gettext
-BuildRequires: pkgconfig(xext) pkgconfig(xt) pkgconfig(xau)
-BuildRequires: ncompress gzip
+BuildRequires: gnupg2
+BuildRequires: gzip
+BuildRequires: make
+BuildRequires: ncompress
+BuildRequires: pkgconfig(glib-2.0)
+BuildRequires: pkgconfig(x11)
+BuildRequires: pkgconfig(xext)
+BuildRequires: pkgconfig(xorg-macros) >= 1.16
+BuildRequires: pkgconfig(xt)
%description
X.Org X11 libXpm runtime library
%package devel
Summary: X.Org X11 libXpm development package
-Requires: %{name} = %{version}-%{release}
+Requires: %{name}%{?_isa} = %{version}-%{release}
%description devel
X.Org X11 libXpm development package
%prep
-%setup -q
+%{gpgverify} --keyring=%{SOURCE2} --signature=%{SOURCE1} --data=%{SOURCE0}
+%autosetup
%build
-autoreconf -v --install --force
%configure --disable-static
-make %{?_smp_mflags}
+%make_build
-%install
-rm -rf $RPM_BUILD_ROOT
+%check
+%make_build check
-make install DESTDIR=$RPM_BUILD_ROOT
+%install
+%make_install
# We intentionally don't ship *.la files
-rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
-
-%ldconfig_post
-%ldconfig_postun
+find %{buildroot} -name '*.la' -delete
%files
-%doc AUTHORS COPYING ChangeLog
+%license COPYING
+%doc AUTHORS ChangeLog README.md
%{_libdir}/libXpm.so.4
%{_libdir}/libXpm.so.4.11.0
@@ -58,3 +65,4 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
%changelog
%autochangelog
+
diff --git a/sources b/sources
index 73c1056..28d3f76 100644
--- a/sources
+++ b/sources
@@ -1 +1,3 @@
-SHA512 (libXpm-3.5.17.tar.xz) = 52f9d2664a47a26c1a6ad65d18867de870b66947b0b0d99cca3512756a0aaa6ce2a245c0b49f20b70c3ce48bf04c47c333e8119a147465c277bca727f6ab017e
+SHA512 (libXpm-3.5.19.tar.xz.sig) = fb26d5fdaa34d81e7c4794a38a4741d122e797f94e89139071906798fb17cef4e2b3b9f9a8800cb116f477782c7e82bea22ea2bb96c213417988c1ae3c5c8b4d
+SHA512 (libXpm-3.5.19.tar.xz) = dd95a70af0ac2fb0f5876e69ad19b38128c5add94b00238ee41a22634aa4dc56b22c1b47c4baa6a1ab549308d11b302c250b405322da8a64ea24441a065fbada
+SHA512 (gpgkey-67DC86F2623FC5FD4BB5225D14706DBE1E4B4540.gpg) = 7983cc4b7905b3eb0c14b15fd379c657cfde76969e9f765fe31fcbd0aafee405f3df87c31671f93f4bea0330a1f317676f4f4db62379471351c0c116b755ff18
reply other threads:[~2026-07-27 6:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178513236640.1.5738580296919448024.rpms-libXpm-1be01b2df08a@fedoraproject.org \
--to=rosset.filipe@gmail.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox