[rpms/libslirp] rawhide: new version, fixes CVE-2026-95507 & CVE-2026-95508

[rpms/libslirp] rawhide: new version, fixes CVE-2026-95507 & CVE-2026-95508

[@ 2026-09-22 8:28 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/libslirp
            Branch : rawhide
            Commit : 949a01deaf0d623edf157617f0e74408d1950809
            Author : Marc-André Lureau <marcandre.lureau@redhat.com>
            Date   : 2026-09-22T12:28:04+04:00
            Stats  : +9/-3 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/libslirp/c/949a01deaf0d623edf157617f0e74408d1950809?branch=rawhide

            Log:
            new version, fixes CVE-2026-95507 & CVE-2026-95508

Fixes: rhbz#2524215

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

---
diff --git a/.gitignore b/.gitignore
index 23db91c..e5f2d95 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@
 /libslirp-4.9.1.tar.xz
 /libslirp-4.9.2.tar.xz
 /libslirp-4.9.3.tar.xz
+/libslirp-4.9.5.tar.xz

diff --git a/libslirp.spec b/libslirp.spec
index 7f5a2be..929ba51 100644
--- a/libslirp.spec
+++ b/libslirp.spec
@@ -1,6 +1,6 @@
 Name:           libslirp
-Version:        4.9.3
-Release:        2%{?dist}
+Version:        4.9.5
+Release:        1%{?dist}
 Summary:        A general purpose TCP-IP emulator
 
 # check the SPDX tags in source files for details
@@ -52,6 +52,11 @@ developing applications that use %{name}.
 
 
 %changelog
+* Tue Sep 22 2026 Marc-André Lureau <marcandre.lureau@redhat.com> - 4.9.5-1
+- new version, rhbz#2524215
+- Fix CVE-2026-95508: heap buffer overflow in DHCPv6/TFTP response builders on small interface MTU
+- Fix CVE-2026-95507: out-of-bounds read in NC-SI OEM response handler discloses host memory to guest
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 4.9.3-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 

diff --git a/sources b/sources
index 64c522b..cd4042e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libslirp-4.9.3.tar.xz) = 0a4d7e977d9877cc59298a05df58d285e58e0d9e80ccdcc4c95c5984e177b5642319d54b07fa650317c5a1c2a1a16d11a26cbd1e9b165724607b428d05c34a15
+SHA512 (libslirp-4.9.5.tar.xz) = daede9dfe0c5f4e14258f66e46eef3475a79da61e88e5e19bf1a283002dfbc6a0ea72961e6aee1b6fa1ab39ea435a48d6c371f195138573e40854415b45941c9