[AutoPR- Security] Patch bison for CVE-2026-56389 [MEDIUM]

SPECS/bison/CVE-2026-56389.patch

@@ -0,0 +1,58 @@
+From 419f5a5f40e2ba05d3591081c48ef16e3321e3e1 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 23 Apr 2026 09:20:43 -0700
+Subject: [PATCH] html: use xsltproc from PATH
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* src/print-xml.c (print_html):
+* src/reader.c (prepare_percent_define_front_end_variables):
+Drop undocumented support for lines like ‘%define tool.xsltproc
+"whatever"’, as this can cause more trouble than it cures.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://cgit.git.savannah.gnu.org/cgit/bison.git/patch/?id=3169c1e7a2c6acc4c59dfcf8b089896d6881925b
+---
+ src/print-xml.c | 4 +---
+ src/reader.c    | 1 -
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/src/print-xml.c b/src/print-xml.c
+index 78801db..ddfdeee 100644
+--- a/src/print-xml.c
++++ b/src/print-xml.c
+@@ -543,10 +543,9 @@ print_html (void)
+   assert (xml_flag);
+
+   char *xml2html = xpath_join (pkgdatadir (), "xslt/xml2xhtml.xsl");
+-  char *xsltproc = muscle_percent_define_get ("tool.xsltproc");
+   char const *argv[11];
+   int i = 0;
+-  argv[i++] = xsltproc;
++  argv[i++] = "xsltproc";
+   argv[i++] = "-o";
+   argv[i++] = spec_html_file;
+   argv[i++] = xml2html;
+@@ -572,6 +571,5 @@ print_html (void)
+                /* termsigp */ NULL);
+   if (status)
+     complain (NULL, complaint, _("%s failed with status %d"), argv[0], status);
+-  free (xsltproc);
+   free (xml2html);
+ }
+diff --git a/src/reader.c b/src/reader.c
+index 024606d..36b3494 100644
+--- a/src/reader.c
++++ b/src/reader.c
+@@ -788,7 +788,6 @@ prepare_percent_define_front_end_variables (void)
+       muscle_percent_define_default ("lr.default-reduction", "accepting");
+     free (lr_type);
+   }
+-  muscle_percent_define_default ("tool.xsltproc", "xsltproc");
+
+   /* Check %define front-end variables.  */
+   {
+-- 
+2.45.4
+

SPECS/bison/bison.spec

@@ -1,13 +1,14 @@
 Summary:        Contains a parser generator
 Name:           bison
 Version:        3.8.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        GPLv3+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Group:          System Environment/Base
 URL:            https://www.gnu.org/software/bison
 Source0:        https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz
+Patch0:         CVE-2026-56389.patch
 
 BuildRequires:  flex
 BuildRequires:  m4
@@ -21,6 +22,7 @@ This package contains a parser generator
 
 %prep
 %setup -q
+%patch 0 -p1
 
 %build
 #make some fixes required by glibc-2.28:
@@ -55,6 +57,9 @@ make %{?_smp_mflags} check
 %{_docdir}/bison/*
 
 %changelog
+* Thu Jul 30 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.8.2-2
+- Patch for CVE-2026-56389
+
 * Mon Oct 16 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 3.8.2-1
 - Auto-upgrade to 3.8.2 - Azure Linux 3.0 - package upgrades
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -84,7 +84,7 @@ zstd-libs-1.5.5-2.azl3.aarch64.rpm
 libtool-2.4.7-2.azl3.aarch64.rpm
 flex-2.6.4-7.azl3.aarch64.rpm
 flex-devel-2.6.4-7.azl3.aarch64.rpm
-bison-3.8.2-1.azl3.aarch64.rpm
+bison-3.8.2-2.azl3.aarch64.rpm
 popt-1.19-1.azl3.aarch64.rpm
 popt-devel-1.19-1.azl3.aarch64.rpm
 popt-lang-1.19-1.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -84,7 +84,7 @@ zstd-libs-1.5.5-2.azl3.x86_64.rpm
 libtool-2.4.7-2.azl3.x86_64.rpm
 flex-2.6.4-7.azl3.x86_64.rpm
 flex-devel-2.6.4-7.azl3.x86_64.rpm
-bison-3.8.2-1.azl3.x86_64.rpm
+bison-3.8.2-2.azl3.x86_64.rpm
 popt-1.19-1.azl3.x86_64.rpm
 popt-devel-1.19-1.azl3.x86_64.rpm
 popt-lang-1.19-1.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -33,8 +33,8 @@ bash-lang-5.2.15-3.azl3.aarch64.rpm
 binutils-2.41-13.azl3.aarch64.rpm
 binutils-debuginfo-2.41-13.azl3.aarch64.rpm
 binutils-devel-2.41-13.azl3.aarch64.rpm
-bison-3.8.2-1.azl3.aarch64.rpm
-bison-debuginfo-3.8.2-1.azl3.aarch64.rpm
+bison-3.8.2-2.azl3.aarch64.rpm
+bison-debuginfo-3.8.2-2.azl3.aarch64.rpm
 bzip2-1.0.8-2.azl3.aarch64.rpm
 bzip2-debuginfo-1.0.8-2.azl3.aarch64.rpm
 bzip2-devel-1.0.8-2.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -36,8 +36,8 @@ binutils-2.41-13.azl3.x86_64.rpm
 binutils-aarch64-linux-gnu-2.41-13.azl3.x86_64.rpm
 binutils-debuginfo-2.41-13.azl3.x86_64.rpm
 binutils-devel-2.41-13.azl3.x86_64.rpm
-bison-3.8.2-1.azl3.x86_64.rpm
-bison-debuginfo-3.8.2-1.azl3.x86_64.rpm
+bison-3.8.2-2.azl3.x86_64.rpm
+bison-debuginfo-3.8.2-2.azl3.x86_64.rpm
 bzip2-1.0.8-2.azl3.x86_64.rpm
 bzip2-debuginfo-1.0.8-2.azl3.x86_64.rpm
 bzip2-devel-1.0.8-2.azl3.x86_64.rpm