From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Filipe Rosset To: git-commits@fedoraproject.org Subject: [rpms/libXpm] rawhide: update to 3.5.19 fixes CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() Date: Mon, 27 Jul 2026 06:06:06 GMT Message-ID: <178513236640.1.5738580296919448024.rpms-libXpm-1be01b2df08a@fedoraproject.org> List-ID: X-Git-Repo: rpms/libXpm X-Git-Branch: rawhide X-Git-Rev: 1be01b2df08a2c94215a5cf3ab4315e3e20f5857 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbGliWHBtCkJyYW5j aCA6IHJhd2hpZGUKQ29tbWl0IDogMWJlMDFiMmRmMDhhMmM5NDIxNWE1Y2YzYWI0MzE1ZTNlMjBm NTg1NwpBdXRob3IgOiBGaWxpcGUgUm9zc2V0IDxyb3NzZXQuZmlsaXBlQGdtYWlsLmNvbT4KRGF0 ZSAgIDogMjAyNi0wNy0yNVQxODoxODo1NS0wMzowMApTdGF0cyAgOiArMzEvLTE5IGluIDMgZmls ZShzKQpVUkwgICAgOiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2xpYlhwbS9j LzFiZTAxYjJkZjA4YTJjOTQyMTVhNWNmM2FiNDMxNWUzZTIwZjU4NTc/YnJhbmNoPXJhd2hpZGUK CkxvZzoKdXBkYXRlIHRvIDMuNS4xOSBmaXhlcyBDVkUtMjAyNi00MzY3OiBsaWJYcG0gT3V0LW9m LWJvdW5kcyByZWFkIGluIHhwbU5leHRXb3JkKCkKCi0tLQpkaWZmIC0tZ2l0IGEvLmdpdGlnbm9y ZSBiLy5naXRpZ25vcmUKaW5kZXggYWU4YTI1ZC4uYTlmNmI3MSAxMDA2NDQKLS0tIGEvLmdpdGln bm9yZQorKysgYi8uZ2l0aWdub3JlCkBAIC0xICsxLDMgQEAKIC9saWJYcG0tKi50YXIueHoKKy9s aWJYcG0tMy41LjE5LnRhci54ei5zaWcKKy9ncGdrZXktNjdEQzg2RjI2MjNGQzVGRDRCQjUyMjVE MTQ3MDZEQkUxRTRCNDU0MC5ncGcKCmRpZmYgLS1naXQgYS9saWJYcG0uc3BlYyBiL2xpYlhwbS5z cGVjCmluZGV4IGE4OWI5NmEuLmM4YTY2MjIgMTAwNjQ0Ci0tLSBhL2xpYlhwbS5zcGVjCisrKyBi L2xpYlhwbS5zcGVjCkBAIC0xLDQ5ICsxLDU2IEBACiBTdW1tYXJ5OiBYLk9yZyBYMTEgbGliWHBt IHJ1bnRpbWUgbGlicmFyeQogTmFtZTogbGliWHBtCi1WZXJzaW9uOiAzLjUuMTcKK1ZlcnNpb246 IDMuNS4xOQogUmVsZWFzZTogJWF1dG9yZWxlYXNlCiBMaWNlbnNlOiBNSVQgQU5EIFgxMS1kaXN0 cmlidXRlLW1vZGlmaWNhdGlvbnMtdmFyaWFudAotVVJMOiBodHRwOi8vd3d3Lngub3JnCitVUkw6 IGh0dHBzOi8vd3d3Lngub3JnCiAKIFNvdXJjZTA6IGh0dHBzOi8vd3d3Lngub3JnL3B1Yi9pbmRp dmlkdWFsL2xpYi8le25hbWV9LSV7dmVyc2lvbn0udGFyLnh6CitTb3VyY2UxOiBodHRwczovL3d3 dy54Lm9yZy9wdWIvaW5kaXZpZHVhbC9saWIvJXtuYW1lfS0le3ZlcnNpb259LnRhci54ei5zaWcK K1NvdXJjZTI6IGdwZ2tleS02N0RDODZGMjYyM0ZDNUZENEJCNTIyNUQxNDcwNkRCRTFFNEI0NTQw LmdwZwogCi1CdWlsZFJlcXVpcmVzOiB4b3JnLXgxMS11dGlsLW1hY3JvcwotQnVpbGRSZXF1aXJl czogYXV0b2NvbmYgYXV0b21ha2UgbGlidG9vbCBtYWtlCitCdWlsZFJlcXVpcmVzOiBnY2MKIEJ1 aWxkUmVxdWlyZXM6IGdldHRleHQKLUJ1aWxkUmVxdWlyZXM6IHBrZ2NvbmZpZyh4ZXh0KSBwa2dj b25maWcoeHQpIHBrZ2NvbmZpZyh4YXUpCi1CdWlsZFJlcXVpcmVzOiBuY29tcHJlc3MgZ3ppcAor QnVpbGRSZXF1aXJlczogZ251cGcyCitCdWlsZFJlcXVpcmVzOiBnemlwCitCdWlsZFJlcXVpcmVz OiBtYWtlCitCdWlsZFJlcXVpcmVzOiBuY29tcHJlc3MKK0J1aWxkUmVxdWlyZXM6IHBrZ2NvbmZp ZyhnbGliLTIuMCkKK0J1aWxkUmVxdWlyZXM6IHBrZ2NvbmZpZyh4MTEpCitCdWlsZFJlcXVpcmVz OiBwa2djb25maWcoeGV4dCkKK0J1aWxkUmVxdWlyZXM6IHBrZ2NvbmZpZyh4b3JnLW1hY3Jvcykg Pj0gMS4xNgorQnVpbGRSZXF1aXJlczogcGtnY29uZmlnKHh0KQogCiAlZGVzY3JpcHRpb24KIFgu T3JnIFgxMSBsaWJYcG0gcnVudGltZSBsaWJyYXJ5CiAKICVwYWNrYWdlIGRldmVsCiBTdW1tYXJ5 OiBYLk9yZyBYMTEgbGliWHBtIGRldmVsb3BtZW50IHBhY2thZ2UKLVJlcXVpcmVzOiAle25hbWV9 ID0gJXt2ZXJzaW9ufS0le3JlbGVhc2V9CitSZXF1aXJlczogJXtuYW1lfSV7P19pc2F9ID0gJXt2 ZXJzaW9ufS0le3JlbGVhc2V9CiAKICVkZXNjcmlwdGlvbiBkZXZlbAogWC5PcmcgWDExIGxpYlhw bSBkZXZlbG9wbWVudCBwYWNrYWdlCiAKICVwcmVwCi0lc2V0dXAgLXEKKyV7Z3BndmVyaWZ5fSAt LWtleXJpbmc9JXtTT1VSQ0UyfSAtLXNpZ25hdHVyZT0le1NPVVJDRTF9IC0tZGF0YT0le1NPVVJD RTB9CislYXV0b3NldHVwCiAKICVidWlsZAotYXV0b3JlY29uZiAtdiAtLWluc3RhbGwgLS1mb3Jj ZQogJWNvbmZpZ3VyZSAtLWRpc2FibGUtc3RhdGljCi1tYWtlICV7P19zbXBfbWZsYWdzfQorJW1h a2VfYnVpbGQKIAotJWluc3RhbGwKLXJtIC1yZiAkUlBNX0JVSUxEX1JPT1QKKyVjaGVjaworJW1h a2VfYnVpbGQgY2hlY2sKIAotbWFrZSBpbnN0YWxsIERFU1RESVI9JFJQTV9CVUlMRF9ST09UCisl aW5zdGFsbAorJW1ha2VfaW5zdGFsbAogCiAjIFdlIGludGVudGlvbmFsbHkgZG9uJ3Qgc2hpcCAq LmxhIGZpbGVzCi1ybSAtZiAkUlBNX0JVSUxEX1JPT1Qle19saWJkaXJ9LyoubGEKLQotJWxkY29u ZmlnX3Bvc3QKLSVsZGNvbmZpZ19wb3N0dW4KK2ZpbmQgJXtidWlsZHJvb3R9IC1uYW1lICcqLmxh JyAtZGVsZXRlCiAKICVmaWxlcwotJWRvYyBBVVRIT1JTIENPUFlJTkcgQ2hhbmdlTG9nCislbGlj ZW5zZSBDT1BZSU5HCislZG9jIEFVVEhPUlMgQ2hhbmdlTG9nIFJFQURNRS5tZAogJXtfbGliZGly fS9saWJYcG0uc28uNAogJXtfbGliZGlyfS9saWJYcG0uc28uNC4xMS4wCiAKQEAgLTU4LDMgKzY1 LDQgQEAgcm0gLWYgJFJQTV9CVUlMRF9ST09UJXtfbGliZGlyfS8qLmxhCiAKICVjaGFuZ2Vsb2cK ICVhdXRvY2hhbmdlbG9nCisKCmRpZmYgLS1naXQgYS9zb3VyY2VzIGIvc291cmNlcwppbmRleCA3 M2MxMDU2Li4yOGQzZjc2IDEwMDY0NAotLS0gYS9zb3VyY2VzCisrKyBiL3NvdXJjZXMKQEAgLTEg KzEsMyBAQAotU0hBNTEyIChsaWJYcG0tMy41LjE3LnRhci54eikgPSA1MmY5ZDI2NjRhNDdhMjZj MWE2YWQ2NWQxODg2N2RlODcwYjY2OTQ3YjBiMGQ5OWNjYTM1MTI3NTZhMGFhYTZjZTJhMjQ1YzBi NDlmMjBiNzBjM2NlNDhiZjA0YzQ3YzMzM2U4MTE5YTE0NzQ2NWMyNzdiY2E3MjdmNmFiMDE3ZQor U0hBNTEyIChsaWJYcG0tMy41LjE5LnRhci54ei5zaWcpID0gZmIyNmQ1ZmRhYTM0ZDgxZTdjNDc5 NGEzOGE0NzQxZDEyMmU3OTdmOTRlODkxMzkwNzE5MDY3OThmYjE3Y2VmNGUyYjNiOWY5YTg4MDBj YjExNmY0Nzc3ODJjN2U4MmJlYTIyZWEyYmI5NmMyMTM0MTc5ODhjMWFlM2M1YzhiNGQKK1NIQTUx MiAobGliWHBtLTMuNS4xOS50YXIueHopID0gZGQ5NWE3MGFmMGFjMmZiMGY1ODc2ZTY5YWQxOWIz ODEyOGM1YWRkOTRiMDAyMzhlZTQxYTIyNjM0YWE0ZGM1NmIyMmMxYjQ3YzRiYWE2YTFhYjU0OTMw OGQxMWIzMDJjMjUwYjQwNTMyMmRhOGE2NGVhMjQ0NDFhMDY1ZmJhZGEKK1NIQTUxMiAoZ3Bna2V5 LTY3REM4NkYyNjIzRkM1RkQ0QkI1MjI1RDE0NzA2REJFMUU0QjQ1NDAuZ3BnKSA9IDc5ODNjYzRi NzkwNWIzZWIwYzE0YjE1ZmQzNzljNjU3Y2ZkZTc2OTY5ZTlmNzY1ZmUzMWZjYmQwYWFmZWU0MDVm M2RmODdjMzE2NzFmOTNmNGJlYTAzMzBhMWYzMTc2NzZmNGY0ZGI2MjM3OTQ3MTM1MWMwYzExNmI3 NTVmZjE4Cg==