public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Pavel Cahyna <pcahyna@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/tar] f44: Bump Release, update %changelog
Date: Mon, 07 Sep 2026 17:57:19 GMT [thread overview]
Message-ID: <178880383931.1.8138321880046398809.rpms-tar-4c7ae1a344f6@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/tar
Branch : f44
Commit : 4c7ae1a344f671aa036a47bd02600f8ff6876113
Author : Pavel Cahyna <pcahyna@redhat.com>
Date : 2026-09-07T17:27:16+02:00
Stats : +12/-1 in 1 file(s)
URL : https://src.fedoraproject.org/rpms/tar/c/4c7ae1a344f671aa036a47bd02600f8ff6876113?branch=f44
Log:
Bump Release, update %changelog
---
diff --git a/tar.spec b/tar.spec
index bc1a65d..8cfe5e0 100644
--- a/tar.spec
+++ b/tar.spec
@@ -10,7 +10,7 @@ Summary: GNU file archiving program
Name: tar
Epoch: 2
Version: 1.35
-Release: 8%{?dist}
+Release: 9%{?dist}
License: GPL-3.0-or-later
URL: https://www.gnu.org/software/tar/
@@ -185,6 +185,17 @@ make check || (
%changelog
+* Mon Sep 7 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-9
+- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) (fedora#2527317)
+- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) (fedora#2498061)
+ Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks) (fedora#2509845).
+- Backport upstream patches for CVE-2026-18477, fixes a bug
+ where incremental restore with cyclic renames between backups
+ may create a temporary directory at an archive-controlled path
+ outside the extraction tree. (fedora#2509846)
+ The fix for CVE-2025-45582 already prevents exploiting
+ this problem, so it is more a correctness and hardening change.
+
* Wed Jan 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
- Backport upstream fix for savannah bug 65838, commit 1e6ce98e (fedora#2427654)
- added "padding with zeros" info message (#2089298)
reply other threads:[~2026-09-07 17:57 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178880383931.1.8138321880046398809.rpms-tar-4c7ae1a344f6@fedoraproject.org \
--to=pcahyna@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox