From 72c7d33e5074a377abe72837df40ec5a64d4f27b Mon Sep 17 00:00:00 2001 From: "Douglas R. Reno" Date: Thu, 14 May 2026 22:39:20 -0500 Subject: [PATCH 1/8] Package updates: - Update to linux-7.0.7 (Security Update) - Update to tcl-8.6.18 - Update to expat-2.8.1 (Security Update) - Update to vim-9.2.0481 (Security Update) - Fix CVE-2026-7210 and CVE-2026-8328 in Python - Update chapter01/whatsnew.xml with a current list of added patches --- chapter01/changelog.xml | 27 +++++++++++++++++++++++++++ chapter01/whatsnew.xml | 11 +++++++---- chapter03/patches.xml | 10 +++++++++- chapter08/python.xml | 4 ++++ chapter08/tcl.xml | 4 ++-- packages.ent | 28 ++++++++++++++-------------- patches.ent | 10 +++++++--- 7 files changed, 70 insertions(+), 24 deletions(-) diff --git a/chapter01/changelog.xml b/chapter01/changelog.xml index 9c4001a62..7c8e87810 100644 --- a/chapter01/changelog.xml +++ b/chapter01/changelog.xml @@ -40,6 +40,33 @@ appropriate for the entry or if needed the entire day's listitem. --> + + 2026-05-14 + + + [renodr] - Update to expat-2.8.1 (Security Update). Fixes + #5933. + + + [renodr] - Update to tcl-8.6.18. Fixes + #5935. + + + [renodr] - Update to vim-9.2.0480 (Security Update). Fixes + #5928. + + + [renodr] - Update to linux-7.0.7 (Security Update). Fixes + #5932. + + + [renodr] - Fix CVE-2026-7210 and CVE-2026-8328 in Python + (Security Update). Fixes + #5934. + + + + 2026-05-11 diff --git a/chapter01/whatsnew.xml b/chapter01/whatsnew.xml index b9a8d440b..9ada1dd34 100644 --- a/chapter01/whatsnew.xml +++ b/chapter01/whatsnew.xml @@ -254,9 +254,9 @@ - + Texinfo-&texinfo-version; @@ -300,8 +300,11 @@ Added: - - Python-3.14.4-security_fixes-1.patch + + glibc-2.43-linux7_fixes-1.patch + Python-3.14.5-openssl_4-1.patch + Python-3.14.5-security_fixes-1.patch + systemd-260.1-buildfix-1.patch diff --git a/chapter03/patches.xml b/chapter03/patches.xml index f5ca5e221..0b3803927 100644 --- a/chapter03/patches.xml +++ b/chapter03/patches.xml @@ -126,7 +126,15 @@ --> - Python OpenSSL 4 Patch - &python-security-fixes-patch-size;: + Python OpenSSL 4 Patch - &python-openssl4-fixes-patch-size;: + + Download: + MD5 sum: &python-openssl4-fixes-patch-md5; + + + + + Python Security Fixes Patch - &python-security-fixes-patch-size;: Download: MD5 sum: &python-security-fixes-patch-md5; diff --git a/chapter08/python.xml b/chapter08/python.xml index fbbbc0afe..7aad5bc61 100644 --- a/chapter08/python.xml +++ b/chapter08/python.xml @@ -45,6 +45,10 @@ First, apply a patch for compatibility with OpenSSL 4: +patch -Np1 -i ../&python-openssl4-fixes-patch; + + Next, fix two security vulnerabilities: + patch -Np1 -i ../&python-security-fixes-patch; Prepare Python for compilation: diff --git a/chapter08/tcl.xml b/chapter08/tcl.xml index 3b37715bd..c822207b7 100644 --- a/chapter08/tcl.xml +++ b/chapter08/tcl.xml @@ -3,8 +3,8 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ %general-entities; - - + + ]> diff --git a/packages.ent b/packages.ent index 365c10197..29e0c95a7 100644 --- a/packages.ent +++ b/packages.ent @@ -148,11 +148,11 @@ - - - + + + - + @@ -425,12 +425,12 @@ - + - + - + - + diff --git a/patches.ent b/patches.ent index 674010d61..8397e61eb 100644 --- a/patches.ent +++ b/patches.ent @@ -41,9 +41,13 @@ --> - - - + + + + + + + + + 2026-05-18 + + + [xry111] - Fix CVE-2026-4046, CVE-2026-5450, and + CVE-2026-5928 in glibc (Security Update). Fixes + #5930. + + + + 2026-05-14 @@ -99,8 +110,7 @@ #5931. - [bdubbs] - Add glibc linux7 fixes patch (Security Fix). Fixes - #5930. + [bdubbs] - Add glibc linux7 fixes patch. [bdubbs] - Add systemd openssl4 build patch. Addresses diff --git a/patches.ent b/patches.ent index 8397e61eb..4f2a29902 100644 --- a/patches.ent +++ b/patches.ent @@ -27,9 +27,9 @@ - - - + + + From d235207a6dfaa102509f8147963167cb91bde505 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Tue, 19 May 2026 10:35:47 +0800 Subject: [PATCH 5/8] glibc: reword for the patch update Remove a sed conflicting with the patch (it's actually doing the same thing as a part of the patch). --- chapter05/glibc.xml | 6 +++++- chapter08/glibc.xml | 10 +++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/chapter05/glibc.xml b/chapter05/glibc.xml index 9c61ac31d..a13e6d423 100644 --- a/chapter05/glibc.xml +++ b/chapter05/glibc.xml @@ -72,10 +72,14 @@ esac patch -Np1 -i ../&glibc-fhs-patch; - Now fix glibc to build against Linux 7. + Now fix glibc to build against Linux 7: patch -Np1 -i ../&glibc-upstream-patch; + The patch applied above also contains fixes of some security + vulnerabilities. The fix is not needed but also harmless for a temporary + glibc installation. + The Glibc documentation recommends building Glibc in a dedicated build directory: diff --git a/chapter08/glibc.xml b/chapter08/glibc.xml index fc6ff3b58..b910d3d4b 100644 --- a/chapter08/glibc.xml +++ b/chapter08/glibc.xml @@ -43,12 +43,6 @@ Installation of Glibc - First, apply a fix to DNS processing from upstream: - -sed -e '/while..ancount/c\ for (; ancount > 0; --ancount)' \ - -e '/binary_hnok..expected/s/expected_name/name_buffer/' \ - -i resolv/nss_dns/dns-host.c - Some of the Glibc programs use the non-FHS compliant /var/db directory to store their runtime data. Apply the following patch to make such programs @@ -56,7 +50,9 @@ patch -Np1 -i ../&glibc-fhs-patch; - Now add some fixes to address building and testing with Linux 7: + Now add some fixes to address building and testing with Linux 7, + and fix 5 security vulnerabilities found after the glibc-2.43 + release: patch -Np1 -i ../&glibc-upstream-patch; From 2ef484f175b26f485d9a9d85fcbd3f292f04e5e8 Mon Sep 17 00:00:00 2001 From: Bruce Dubbs Date: Wed, 20 May 2026 13:30:24 -0500 Subject: [PATCH 6/8] Update to linux-7.0.9 (Security Update). --- chapter01/changelog.xml | 10 ++++++++++ packages.ent | 6 +++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/chapter01/changelog.xml b/chapter01/changelog.xml index 7c8e87810..0ad2551b8 100644 --- a/chapter01/changelog.xml +++ b/chapter01/changelog.xml @@ -40,6 +40,16 @@ appropriate for the entry or if needed the entire day's listitem. --> + + 2026-05-14 + + + [bdubbs] - Update to linux-7.0.9 (Security Update). Fixes + #5928. + + + + 2026-05-14 diff --git a/packages.ent b/packages.ent index 29e0c95a7..81289ffa5 100644 --- a/packages.ent +++ b/packages.ent @@ -425,12 +425,12 @@ - + - + - + + + 2026-05-20 + + + [bdubbs] - Update to linux-7.0.9 (Security Update). Fixes + #5928. + + + + 2026-05-18 @@ -51,16 +61,6 @@ - - 2026-05-14 - - - [bdubbs] - Update to linux-7.0.9 (Security Update). Fixes - #5928. - - - - 2026-05-14 From a29b07aee0f3da618ca3a8bedf98e47c625b45f3 Mon Sep 17 00:00:00 2001 From: "Douglas R. Reno" Date: Wed, 20 May 2026 22:44:29 -0500 Subject: [PATCH 8/8] Patches: Adjust the description of the glibc patch. It's no longer just Linux-7 related. --- chapter03/patches.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chapter03/patches.xml b/chapter03/patches.xml index 0b3803927..fee016912 100644 --- a/chapter03/patches.xml +++ b/chapter03/patches.xml @@ -78,7 +78,7 @@ --> - Glibc Linux7 Fix Patch - &glibc-upstream-patch-size;: + Glibc Upstream Fixes Patch - &glibc-upstream-patch-size;: Download: MD5 sum: &glibc-upstream-patch-md5;