similarity index 50%
rename from meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch
rename to meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41991.patch
@@ -1,4 +1,4 @@
-From 661918c7c0d5acf52508107d6bcdeb72a526ce52 Mon Sep 17 00:00:00 2001
+From 286734a7f791dfb1694bf7d2d61dfae8c8105cc7 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 16 Apr 2026 12:11:44 -0700
Subject: [PATCH] gzexe: use -C if lacking mktemp
@@ -16,16 +16,14 @@ CVE: CVE-2026-41991
Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
- NEWS | 13 +++++++++----
- gzexe.in | 1 +
- zdiff.in | 7 +++----
- 3 files changed, 13 insertions(+), 8 deletions(-)
+ NEWS | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/NEWS b/NEWS
-index 881b6b6..3a05d7e 100644
+index 75836f2..7881350 100644
--- a/NEWS
+++ b/NEWS
-@@ -4,10 +4,6 @@ GNU gzip NEWS -*- outline -*-
+@@ -68,10 +68,6 @@ GNU gzip NEWS -*- outline -*-
** Bug fixes
@@ -36,7 +34,7 @@ index 881b6b6..3a05d7e 100644
'gzip -d' no longer omits the last partial output buffer when the
input ends unexpectedly on an IBM Z platform.
[bug introduced in gzip-1.11]
-@@ -18,6 +14,15 @@ GNU gzip NEWS -*- outline -*-
+@@ -82,6 +78,15 @@ GNU gzip NEWS -*- outline -*-
'gzip -S' now rejects suffixes containing '/'.
[bug present since the beginning]
@@ -52,35 +50,3 @@ index 881b6b6..3a05d7e 100644
** Changes in behavior
The GZIP environment variable is now silently ignored except for the
-diff --git a/gzexe.in b/gzexe.in
-index 1267d6e..09a2571 100644
---- a/gzexe.in
-+++ b/gzexe.in
-@@ -127,6 +127,7 @@ for i do
- tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
- else
- tmp=${dir}gzexe$$
-+ (umask 77; set -C; > "$tmp")
- fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
- res=$?
- printf >&2 '%s\n' "$0: cannot copy $file"
-diff --git a/zdiff.in b/zdiff.in
-index a8689a0..c04a8c0 100644
---- a/zdiff.in
-+++ b/zdiff.in
-@@ -156,12 +156,11 @@ case $file2 in
- *) TMPDIR=/tmp/;;
- esac
- if command -v mktemp >/dev/null 2>&1; then
-- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
-- exit 2
-+ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
- else
-- set -C
- tmp=${TMPDIR}zdiff$$
-- fi
-+ (umask 77; set -C; > "$tmp")
-+ fi &&
- 'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
- gzip_status=$(
- exec 4>&1
similarity index 65%
rename from meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41992.patch
rename to meta/recipes-extended/gzip/gzip-1.15/CVE-2026-41992.patch
@@ -1,7 +1,8 @@
-From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
+From 3a355dd8d9bc7ec9640447e5542acaefecf3fec5 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Wed, 15 Apr 2026 12:00:17 -0700
-Subject: =?UTF-8?q?gzip:=20don=E2=80=99t=20mishandle=20.lzh=20after=20.Z?=
+Subject: [PATCH] =?UTF-8?q?gzip:=20don=E2=80=99t=20mishandle=20.lzh=20afte?=
+ =?UTF-8?q?r=20.Z?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
@@ -14,15 +15,14 @@ Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commi
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
NEWS | 4 ++++
- THANKS | 1 +
unlzh.c | 6 ++++++
- 3 files changed, 11 insertions(+)
+ 2 files changed, 10 insertions(+)
diff --git a/NEWS b/NEWS
-index 6388227..8fb8918 100644
+index a8657a8..75836f2 100644
--- a/NEWS
+++ b/NEWS
-@@ -4,6 +4,10 @@ GNU gzip NEWS -*- outline -*-
+@@ -68,6 +68,10 @@ GNU gzip NEWS -*- outline -*-
** Bug fixes
@@ -33,20 +33,8 @@ index 6388227..8fb8918 100644
'gzip -d' no longer omits the last partial output buffer when the
input ends unexpectedly on an IBM Z platform.
[bug introduced in gzip-1.11]
-diff --git a/THANKS b/THANKS
-index 4e545d9..a7d25e4 100644
---- a/THANKS
-+++ b/THANKS
-@@ -186,6 +186,7 @@ Jamie Lokier u90jl@ecs.oxford.ac.uk
- Richard Lloyd R.K.Lloyd@csc.liv.ac.uk
- David J. MacKenzie djm@eng.umd.edu
- John R MacMillan john@chance.gts.org
-+Michał Majchrowicz mmajchrowicz@afine.com
- Ron Male male@eso.mc.xerox.com
- Jakub Martisko jamartis@redhat.com
- Don R. Maszle maze@bea.lbl.gov
diff --git a/unlzh.c b/unlzh.c
-index 3320196..a6cf109 100644
+index 7fde9c6..2e31c27 100644
--- a/unlzh.c
+++ b/unlzh.c
@@ -232,6 +232,12 @@ read_c_len ()
similarity index 92%
rename from meta/recipes-extended/gzip/gzip-1.14/wrong-path-fix.patch
rename to meta/recipes-extended/gzip/gzip-1.15/wrong-path-fix.patch
@@ -1,4 +1,4 @@
-From eda9b1d08c517acbdc5b26c24c94a3985f29c749 Mon Sep 17 00:00:00 2001
+From 885f15530d7e5442d5399b5216fcfc988eb2d721 Mon Sep 17 00:00:00 2001
From: Ming Liu <ming.liu@windriver.com>
Date: Fri, 21 Nov 2014 04:50:57 -0500
Subject: [PATCH] fix MakeMaker issues with using wrong SHELL/GREP
@@ -20,7 +20,7 @@ Upstream-Status: Pending
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/Makefile.am b/Makefile.am
-index 23e0d3e..3455878 100644
+index 6491c8b..596fd9a 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -95,8 +95,7 @@ SUFFIXES = .in
similarity index 94%
rename from meta/recipes-extended/gzip/gzip_1.14.bb
rename to meta/recipes-extended/gzip/gzip_1.15.bb
@@ -42,4 +42,4 @@ do_install_ptest() {
${B}/tests/Makefile > ${D}${PTEST_PATH}/src/tests/Makefile
}
-SRC_URI[sha256sum] = "613d6ea44f1248d7370c7ccdeee0dd0017a09e6c39de894b3c6f03f981191c6b"
+SRC_URI[sha256sum] = "545886cf57fa88a65e967fbf705903d7fcb2567c82c7342493e82e8d7b1a210b"
Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *gzip* to *1.15* has Succeeded. Next steps: - apply the patch: git am 0001-gzip-upgrade-1.14-1.15.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 22d16541e944eb699afec797afde2b0d00928473 Mon Sep 17 00:00:00 2001 From: Upgrade Helper <auh@yoctoproject.org> Date: Mon, 21 Sep 2026 05:20:52 +0000 Subject: [PATCH] gzip: upgrade 1.14 -> 1.15 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Source: ChangeLog 2026-09-20 Jim Meyering <meyering@meta.com> version 1.15 * NEWS: Record release date. 2026-09-10 Paul Eggert <eggert@cs.ucla.edu> doc: add THANKS for bug report gzip: avoid last_component if !USE_ATFUNCS Problem reported by Bryan M. * gzip.c (atdir_set): New arg PARENTFD. All uses changed. Use the new arg to avoid passing AT_FDCWD to unlinkat when a parent directory was intended. (treat_file) [!USE_ATFUNCS]: Use ifname, not its last component. gzip: use unlinkat only when using openat This is mostly just a cleanup, but the cleanup removes a nagging issue on MS-Windowsish platforms with openat+unlinkat but where you cannot unlink a readonly file. In this case the code used plain open, but used unlinkat, which is questionable. * gzip.c (USE_ATFUNCS): Rename from TRY_OPENING_DIRECTORIES. The old name was misleading, as gzip -r opens directories even when USE_ATFUNCS is false. All uses changed. (gzip_unlinkat, unlinkat) [!USE_ATFUNCS]: New compatibility function and macro. * util.c (xunlinkat): Remove. All uses changed to use unlinkat. 2026-09-05 Paul Eggert <eggert@cs.ucla.edu> gzip: fix undefined behavior with SIGPIPE This problem arose due to a combination of commit bb78ea465787191e8987d4b8a6594f9f23a18930 dated 2013-06-11, which defined SIGPIPE to 0 if not already defined, with commit ede0a8888a4d3d0750e1651e01f198e2faab5d59 dated 2026-05-25, which included tailor.h before all system .h files. Problem and fix reported by Collin Funk (bug#81139). * gzip.c (handled_sig): ifdef, not if, for SIGPIPE. * tailor.h (SIGPIPE): Do not #define to 0, because when we later include <signal.h> its #define yields undefined behavior. maint: update .gitignore files and bootstrap build: configure.ac cruft removal * configure.ac: Do not call AC_PROG_RANLIB, as we no longer use its results ourselves. Do not use AC_C_CONST or AC_TYPE_SIZE_T, as it’s safe to assume C89 now. Do not check for fcntl.h, limits.h, memory.h, time.h, as we no longer use the corresponding HAVE_FCNTL_H etc. macros. Do not check for lstat or siginterrupt, as we no longer use HAVE_LSTAT or HAVE_SIGINTERRUPT. Do not use AC_HEADER_DIRENT, as we no longer use any symbols that it defines. gzip: don’t open same dir twice when recursive Opening it multiple times can lead to races. * gzip.c (treat_file, create_outfile, open_and_stat, open_input_file): New arg parentfd. All uses changed. If nonnegative, treat it as the parent directory file descriptor, instead of dfd or syncdfd. (check_ofname): New arg atfd. All uses changed. (treat_dir): Do not close fd until after processing subsidiaries. Instead, pass it as the parent fd to subroutines. Report any streamsavedir failure. gzip: be more cautious about using AT_FDCWD Without this change, gzip was more vulnerable to attackers changing the directory hierarchy while gzip walks through it. * gzip.c (ATDIR_SET_ERROR): New constant. (atdir_set): Return it on fail [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../CVE-2026-41991.patch | 46 +++---------------- .../CVE-2026-41992.patch | 26 +++-------- .../wrong-path-fix.patch | 4 +- .../gzip/{gzip_1.14.bb => gzip_1.15.bb} | 2 +- 4 files changed, 16 insertions(+), 62 deletions(-) rename meta/recipes-extended/gzip/{gzip-1.14 => gzip-1.15}/CVE-2026-41991.patch (50%) rename meta/recipes-extended/gzip/{gzip-1.14 => gzip-1.15}/CVE-2026-41992.patch (65%) rename meta/recipes-extended/gzip/{gzip-1.14 => gzip-1.15}/wrong-path-fix.patch (92%) rename meta/recipes-extended/gzip/{gzip_1.14.bb => gzip_1.15.bb} (94%)