public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Pavel Cahyna <pcahyna@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/tar] f45: Bump Release, update %changelog
Date: Wed, 09 Sep 2026 13:22:56 GMT [thread overview]
Message-ID: <178896017617.1.9885820526842489464.rpms-tar-e4e337c57a86@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/tar
Branch : f45
Commit : e4e337c57a86b5faa686872c6d7f22d58686e66c
Author : Pavel Cahyna <pcahyna@redhat.com>
Date : 2026-09-07T17:21:01+02:00
Stats : +12/-1 in 1 file(s)
URL : https://src.fedoraproject.org/rpms/tar/c/e4e337c57a86b5faa686872c6d7f22d58686e66c?branch=f45
Log:
Bump Release, update %changelog
---
diff --git a/tar.spec b/tar.spec
index c59bdba..3eb64a0 100644
--- a/tar.spec
+++ b/tar.spec
@@ -10,7 +10,7 @@ Summary: GNU file archiving program
Name: tar
Epoch: 2
Version: 1.35
-Release: 9%{?dist}
+Release: 10%{?dist}
License: GPL-3.0-or-later
URL: https://www.gnu.org/software/tar/
@@ -185,6 +185,17 @@ make check || (
%changelog
+* Mon Sep 7 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-10
+- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) (fedora#2527317)
+- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) (fedora#2498061)
+ Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks) (fedora#2509845).
+- Backport upstream patches for CVE-2026-18477, fixes a bug
+ where incremental restore with cyclic renames between backups
+ may create a temporary directory at an archive-controlled path
+ outside the extraction tree. (fedora#2509846)
+ The fix for CVE-2025-45582 already prevents exploiting
+ this problem, so it is more a correctness and hardening change.
+
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.35-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
reply other threads:[~2026-09-09 13:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178896017617.1.9885820526842489464.rpms-tar-e4e337c57a86@fedoraproject.org \
--to=pcahyna@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox