From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Chris Leech To: git-commits@fedoraproject.org Subject: [rpms/isns-utils] rawhide: CVE-2026-55995: Denial of Service via double-free in iSNS attribute decoder (rhbz#2508456) Date: Wed, 29 Jul 2026 23:37:16 GMT Message-ID: <178536823647.1.4099257272732336396.rpms-isns-utils-9939d99242ec@fedoraproject.org> List-ID: X-Git-Repo: rpms/isns-utils X-Git-Branch: rawhide X-Git-Rev: 9939d99242ecece582e98e37bf6ceb30fc69e338 ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvaXNucy11dGlscwogICAgICAgICAgICBCcmFuY2ggOiByYXdoaWRlCiAgICAg ICAgICAgIENvbW1pdCA6IDk5MzlkOTkyNDJlY2VjZTU4MmU5OGUzN2JmNmNlYjMwZmM2OWUzMzgK ICAgICAgICAgICAgQXV0aG9yIDogQ2hyaXMgTGVlY2ggPGNsZWVjaEByZWRoYXQuY29tPgogICAg ICAgICAgICBEYXRlICAgOiAyMDI2LTA3LTI5VDE1OjQxOjAwLTA3OjAwCiAgICAgICAgICAgIFN0 YXRzICA6ICs0MC8tMCBpbiAyIGZpbGUocykKICAgICAgICAgICAgVVJMICAgIDogaHR0cHM6Ly9z cmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9pc25zLXV0aWxzL2MvOTkzOWQ5OTI0MmVjZWNlNTgy ZTk4ZTM3YmY2Y2ViMzBmYzY5ZTMzOD9icmFuY2g9cmF3aGlkZQoKICAgICAgICAgICAgTG9nOgog ICAgICAgICAgICBDVkUtMjAyNi01NTk5NTogRGVuaWFsIG9mIFNlcnZpY2UgdmlhIGRvdWJsZS1m cmVlIGluIGlTTlMgYXR0cmlidXRlIGRlY29kZXIgKHJoYnojMjUwODQ1NikKClNpZ25lZC1vZmYt Ynk6IENocmlzIExlZWNoIDxjbGVlY2hAcmVkaGF0LmNvbT4KCi0tLQpkaWZmIC0tZ2l0IGEvMDAw MS1GaXgtaXNzdWUtaW4tZXJyb3ItcGF0aC1jYXVzaW5nLWRvdWJsZS1mcmVlLnBhdGNoIGIvMDAw MS1GaXgtaXNzdWUtaW4tZXJyb3ItcGF0aC1jYXVzaW5nLWRvdWJsZS1mcmVlLnBhdGNoCm5ldyBm aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjcwMjVhOTIKLS0tIC9kZXYvbnVsbAorKysg Yi8wMDAxLUZpeC1pc3N1ZS1pbi1lcnJvci1wYXRoLWNhdXNpbmctZG91YmxlLWZyZWUucGF0Y2gK QEAgLTAsMCArMSwzOSBAQAorRnJvbSA1NjcxOGQ0ZTlkMWE0ZjUxYzMwNjk3YjVjMDUzNDE0NGJi NDFjOWJiIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQorRnJvbTogTGVlIER1bmNhbiA8bGR1bmNh bkBzdXNlLmNvbT4KK0RhdGU6IFR1ZSwgMjggSnVsIDIwMjYgMTE6MDc6MjQgLTA3MDAKK1N1Ympl Y3Q6IFtQQVRDSCAxLzFdIEZpeCBpc3N1ZSBpbiBlcnJvciBwYXRoIGNhdXNpbmcgZG91YmxlLWZy ZWUuCisKK0luIGF0dHJzLmMsIHdoZW4gYnVmX2dldCgpIGZhaWxzIGFuZCBhbGxvY2F0ZWQgbWVt b3J5IGlzCitmcmVlZCwgd2UgYWxzbyBuZWVkIHRvIHNldCB0aGUgcG9pbnRlciB0byB0aGF0IG1l bW9yeSB0bworTlVMTCwgdG8gcHJldmVudCBhIGRvdWJsZSBmcmVlIGZyb20gb2NjdXJpbmcsIHdv dWxkIGNvdWxkCitsZWFkIHRvIGEgRG9TIGF0dGFjay4KKworUmVmZXJlbmNlczogQ1ZFLTIwMjYt NTU5OTUKK0ZvdW5kLWJ5OiA8a2VpdGhAbGlubmVtYW5sYWJzLmNvbT4KKy0tLQorIGF0dHJzLmMg fCAyICsrCisgMSBmaWxlIGNoYW5nZWQsIDIgaW5zZXJ0aW9ucygrKQorCitkaWZmIC0tZ2l0IGEv YXR0cnMuYyBiL2F0dHJzLmMKK2luZGV4IGExMmMyMjIuLjE1YzkzMGQgMTAwNjQ0CistLS0gYS9h dHRycy5jCisrKysgYi9hdHRycy5jCitAQCAtMTM3MSw2ICsxMzcxLDcgQEAgaXNuc19hdHRyX3R5 cGVfc3RyaW5nX2RlY29kZShidWZfdCAqYnAsIHNpemVfdCBsZW4sIGlzbnNfdmFsdWVfdCAqdmFs dWUpCisgCXZhbHVlLT5pdl9zdHJpbmcgPSBpc25zX21hbGxvYyhsZW4gKyAxKTsKKyAJaWYgKCFi dWZfZ2V0KGJwLCB2YWx1ZS0+aXZfc3RyaW5nLCBsZW4pKSB7CisgCQlpc25zX2ZyZWUodmFsdWUt Pml2X3N0cmluZyk7CisrCQl2YWx1ZS0+aXZfc3RyaW5nID0gTlVMTDsKKyAJCXJldHVybiAwOwor IAl9CisgCXZhbHVlLT5pdl9zdHJpbmdbbGVuXSA9ICdcMCc7CitAQCAtMTU0Niw2ICsxNTQ3LDcg QEAgaXNuc19hdHRyX3R5cGVfb3BhcXVlX2RlY29kZShidWZfdCAqYnAsIHNpemVfdCBsZW4sIGlz bnNfdmFsdWVfdCAqdmFsdWUpCisgCXZhbHVlLT5pdl9vcGFxdWUucHRyID0gaXNuc19tYWxsb2Mo bGVuKTsKKyAJaWYgKCFidWZfZ2V0KGJwLCB2YWx1ZS0+aXZfb3BhcXVlLnB0ciwgbGVuKSkgewor IAkJaXNuc19mcmVlKHZhbHVlLT5pdl9vcGFxdWUucHRyKTsKKysJCXZhbHVlLT5pdl9vcGFxdWUu cHRyID0gTlVMTDsKKyAJCXJldHVybiAwOworIAl9CisgCistLSAKKzIuNTUuMAorCgpkaWZmIC0t Z2l0IGEvaXNucy11dGlscy5zcGVjIGIvaXNucy11dGlscy5zcGVjCmluZGV4IGY3Y2MzNzIuLmUx ZDEyZWEgMTAwNjQ0Ci0tLSBhL2lzbnMtdXRpbHMuc3BlYworKysgYi9pc25zLXV0aWxzLnNwZWMK QEAgLTgsNiArOCw3IEBAIFVSTDogICAgICAgICAgICBodHRwczovL2dpdGh1Yi5jb20vb3Blbi1p c2NzaS9vcGVuLWlzbnMKIFNvdXJjZTA6ICAgICAgICBodHRwczovL2dpdGh1Yi5jb20vb3Blbi1p c2NzaS9vcGVuLWlzbnMvYXJjaGl2ZS92JXt2ZXJzaW9ufS50YXIuZ3ojL29wZW4taXNucy0le3Zl cnNpb259LnRhci5negogU291cmNlMTogICAgICAgIGlzbnNkLnNlcnZpY2UKIFBhdGNoMTogICAg ICAgICB0ZXN0X2FzX2luc3RhbGxlZC5wYXRjaAorUGF0Y2gyOiAgICAgICAgIDAwMDEtRml4LWlz c3VlLWluLWVycm9yLXBhdGgtY2F1c2luZy1kb3VibGUtZnJlZS5wYXRjaAogCiBCdWlsZFJlcXVp cmVzOiAgZ2NjCiBCdWlsZFJlcXVpcmVzOiAgcGtnY29uZmlnIHN5c3RlbWQtZGV2ZWwgc3lzdGVt ZAo=