diff --git a/SPECS/bison/CVE-2026-56389.patch b/SPECS/bison/CVE-2026-56389.patch new file mode 100644 index 00000000000..0a89e7578d2 --- /dev/null +++ b/SPECS/bison/CVE-2026-56389.patch @@ -0,0 +1,58 @@ +From 419f5a5f40e2ba05d3591081c48ef16e3321e3e1 Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 23 Apr 2026 09:20:43 -0700 +Subject: [PATCH] html: use xsltproc from PATH +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +* src/print-xml.c (print_html): +* src/reader.c (prepare_percent_define_front_end_variables): +Drop undocumented support for lines like ‘%define tool.xsltproc +"whatever"’, as this can cause more trouble than it cures. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://cgit.git.savannah.gnu.org/cgit/bison.git/patch/?id=3169c1e7a2c6acc4c59dfcf8b089896d6881925b +--- + src/print-xml.c | 4 +--- + src/reader.c | 1 - + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/print-xml.c b/src/print-xml.c +index 78801db..ddfdeee 100644 +--- a/src/print-xml.c ++++ b/src/print-xml.c +@@ -543,10 +543,9 @@ print_html (void) + assert (xml_flag); + + char *xml2html = xpath_join (pkgdatadir (), "xslt/xml2xhtml.xsl"); +- char *xsltproc = muscle_percent_define_get ("tool.xsltproc"); + char const *argv[11]; + int i = 0; +- argv[i++] = xsltproc; ++ argv[i++] = "xsltproc"; + argv[i++] = "-o"; + argv[i++] = spec_html_file; + argv[i++] = xml2html; +@@ -572,6 +571,5 @@ print_html (void) + /* termsigp */ NULL); + if (status) + complain (NULL, complaint, _("%s failed with status %d"), argv[0], status); +- free (xsltproc); + free (xml2html); + } +diff --git a/src/reader.c b/src/reader.c +index 024606d..36b3494 100644 +--- a/src/reader.c ++++ b/src/reader.c +@@ -788,7 +788,6 @@ prepare_percent_define_front_end_variables (void) + muscle_percent_define_default ("lr.default-reduction", "accepting"); + free (lr_type); + } +- muscle_percent_define_default ("tool.xsltproc", "xsltproc"); + + /* Check %define front-end variables. */ + { +-- +2.45.4 + diff --git a/SPECS/bison/bison.spec b/SPECS/bison/bison.spec index 98720385231..22deffcca62 100644 --- a/SPECS/bison/bison.spec +++ b/SPECS/bison/bison.spec @@ -1,13 +1,14 @@ Summary: Contains a parser generator Name: bison Version: 3.8.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv3+ Vendor: Microsoft Corporation Distribution: Azure Linux Group: System Environment/Base URL: https://www.gnu.org/software/bison Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz +Patch0: CVE-2026-56389.patch BuildRequires: flex BuildRequires: m4 @@ -21,6 +22,7 @@ This package contains a parser generator %prep %setup -q +%patch 0 -p1 %build #make some fixes required by glibc-2.28: @@ -55,6 +57,9 @@ make %{?_smp_mflags} check %{_docdir}/bison/* %changelog +* Thu Jul 30 2026 Azure Linux Security Servicing Account - 3.8.2-2 +- Patch for CVE-2026-56389 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 3.8.2-1 - Auto-upgrade to 3.8.2 - Azure Linux 3.0 - package upgrades diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 8ab5a0b3de7..0bd68997f1a 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -84,7 +84,7 @@ zstd-libs-1.5.5-2.azl3.aarch64.rpm libtool-2.4.7-2.azl3.aarch64.rpm flex-2.6.4-7.azl3.aarch64.rpm flex-devel-2.6.4-7.azl3.aarch64.rpm -bison-3.8.2-1.azl3.aarch64.rpm +bison-3.8.2-2.azl3.aarch64.rpm popt-1.19-1.azl3.aarch64.rpm popt-devel-1.19-1.azl3.aarch64.rpm popt-lang-1.19-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index c32b6a22a6b..6b3f1aeddc1 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -84,7 +84,7 @@ zstd-libs-1.5.5-2.azl3.x86_64.rpm libtool-2.4.7-2.azl3.x86_64.rpm flex-2.6.4-7.azl3.x86_64.rpm flex-devel-2.6.4-7.azl3.x86_64.rpm -bison-3.8.2-1.azl3.x86_64.rpm +bison-3.8.2-2.azl3.x86_64.rpm popt-1.19-1.azl3.x86_64.rpm popt-devel-1.19-1.azl3.x86_64.rpm popt-lang-1.19-1.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index fedcd7bd115..b3e29187406 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -33,8 +33,8 @@ bash-lang-5.2.15-3.azl3.aarch64.rpm binutils-2.41-13.azl3.aarch64.rpm binutils-debuginfo-2.41-13.azl3.aarch64.rpm binutils-devel-2.41-13.azl3.aarch64.rpm -bison-3.8.2-1.azl3.aarch64.rpm -bison-debuginfo-3.8.2-1.azl3.aarch64.rpm +bison-3.8.2-2.azl3.aarch64.rpm +bison-debuginfo-3.8.2-2.azl3.aarch64.rpm bzip2-1.0.8-2.azl3.aarch64.rpm bzip2-debuginfo-1.0.8-2.azl3.aarch64.rpm bzip2-devel-1.0.8-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index ada6e3a3897..c761f53d0fb 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -36,8 +36,8 @@ binutils-2.41-13.azl3.x86_64.rpm binutils-aarch64-linux-gnu-2.41-13.azl3.x86_64.rpm binutils-debuginfo-2.41-13.azl3.x86_64.rpm binutils-devel-2.41-13.azl3.x86_64.rpm -bison-3.8.2-1.azl3.x86_64.rpm -bison-debuginfo-3.8.2-1.azl3.x86_64.rpm +bison-3.8.2-2.azl3.x86_64.rpm +bison-debuginfo-3.8.2-2.azl3.x86_64.rpm bzip2-1.0.8-2.azl3.x86_64.rpm bzip2-debuginfo-1.0.8-2.azl3.x86_64.rpm bzip2-devel-1.0.8-2.azl3.x86_64.rpm