From fa76b3cbf58db89fba1ccb048828d8ee40ac8bb6 Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Sun, 28 Sep 2025 10:04:41 +0530 Subject: [PATCH 1/7] Update to 12.0.0 version (#2399955) --- .gitignore | 1 + harfbuzz.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 443fb4d..14e1ff1 100644 --- a/.gitignore +++ b/.gitignore @@ -172,3 +172,4 @@ /harfbuzz-11.4.5.tar.xz /harfbuzz-11.5.0.tar.xz /harfbuzz-11.5.1.tar.xz +/harfbuzz-12.0.0.tar.xz diff --git a/harfbuzz.spec b/harfbuzz.spec index f100dfa..0ddb786 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,5 +1,5 @@ Name: harfbuzz -Version: 11.5.1 +Version: 12.0.0 Release: 1%{?dist} Summary: Text shaping library @@ -110,6 +110,9 @@ This package contains Harfbuzz Cairo support library. %{_libdir}/libharfbuzz-cairo.so.* %changelog +* Sun Sep 28 2025 Parag Nemade - 12.0.0-1 +- Update to 12.0.0 version (#2399955) + * Tue Sep 23 2025 Parag Nemade - 11.5.1-1 - Update to 11.5.1 version (#2397450) diff --git a/sources b/sources index 4df73bd..6095c91 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (harfbuzz-11.5.1.tar.xz) = c5525837cba6fd2d79660ffcf4069b107fa60eec21daeb89fb529c9b2a388392e92aca896c503fdd9545050ffc8e831281141fcfe816fee74b997a465ff2b528 +SHA512 (harfbuzz-12.0.0.tar.xz) = 0592217ae45ec202e452d2d6924636d3bdb3ba0f9dde522ee40743c12d6a9c3fface6ec756e3b1a892d5e15a8c60f0cfb31029b2f34198d09a0392ff4a2814d8 From 22103b9cd624e27e853791ad8f612d9aabd8e9a3 Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Thu, 2 Oct 2025 08:20:16 +0530 Subject: [PATCH 2/7] Update to 12.1.0 version (#2400640) --- .gitignore | 1 + harfbuzz.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 14e1ff1..883f537 100644 --- a/.gitignore +++ b/.gitignore @@ -173,3 +173,4 @@ /harfbuzz-11.5.0.tar.xz /harfbuzz-11.5.1.tar.xz /harfbuzz-12.0.0.tar.xz +/harfbuzz-12.1.0.tar.xz diff --git a/harfbuzz.spec b/harfbuzz.spec index 0ddb786..7a1a884 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,5 +1,5 @@ Name: harfbuzz -Version: 12.0.0 +Version: 12.1.0 Release: 1%{?dist} Summary: Text shaping library @@ -110,6 +110,9 @@ This package contains Harfbuzz Cairo support library. %{_libdir}/libharfbuzz-cairo.so.* %changelog +* Thu Oct 02 2025 Parag Nemade - 12.1.0-1 +- Update to 12.1.0 version (#2400640) + * Sun Sep 28 2025 Parag Nemade - 12.0.0-1 - Update to 12.0.0 version (#2399955) diff --git a/sources b/sources index 6095c91..f4229b7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (harfbuzz-12.0.0.tar.xz) = 0592217ae45ec202e452d2d6924636d3bdb3ba0f9dde522ee40743c12d6a9c3fface6ec756e3b1a892d5e15a8c60f0cfb31029b2f34198d09a0392ff4a2814d8 +SHA512 (harfbuzz-12.1.0.tar.xz) = 94cbc3fe8fad30f4f7871bdddc8b129c486ab55329f9b48c6336fdf15d05f09c3c96cac51f68a0218db113b4783c07ce5d6bb455ccc875b31fd2261e3e8dc559 From 64392f3cc6c4409aa4e25892dbd31ec9290197a6 Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Fri, 7 Nov 2025 21:42:51 +0530 Subject: [PATCH 3/7] Update to 12.2.0 version (#2412425) --- .gitignore | 1 + harfbuzz.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 883f537..3bcd9fb 100644 --- a/.gitignore +++ b/.gitignore @@ -174,3 +174,4 @@ /harfbuzz-11.5.1.tar.xz /harfbuzz-12.0.0.tar.xz /harfbuzz-12.1.0.tar.xz +/harfbuzz-12.2.0.tar.xz diff --git a/harfbuzz.spec b/harfbuzz.spec index 7a1a884..0abd171 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,5 +1,5 @@ Name: harfbuzz -Version: 12.1.0 +Version: 12.2.0 Release: 1%{?dist} Summary: Text shaping library @@ -110,6 +110,9 @@ This package contains Harfbuzz Cairo support library. %{_libdir}/libharfbuzz-cairo.so.* %changelog +* Fri Nov 07 2025 Parag Nemade - 12.2.0-1 +- Update to 12.2.0 version (#2412425) + * Thu Oct 02 2025 Parag Nemade - 12.1.0-1 - Update to 12.1.0 version (#2400640) diff --git a/sources b/sources index f4229b7..9b0fdfb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (harfbuzz-12.1.0.tar.xz) = 94cbc3fe8fad30f4f7871bdddc8b129c486ab55329f9b48c6336fdf15d05f09c3c96cac51f68a0218db113b4783c07ce5d6bb455ccc875b31fd2261e3e8dc559 +SHA512 (harfbuzz-12.2.0.tar.xz) = 7e7cd5dfdbf8848c3c078628f2cf355db6dcc938083fa7d2f69ab6f174041dc64fae1973f97a1649dfcf9f2bf143517329efb3f67ccfe8996eb84b6ff52f4029 From 911e8d14640b7db83b7b6cda0213049f3799833d Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Sun, 28 Dec 2025 11:17:00 +0530 Subject: [PATCH 4/7] Update to 12.3.0 version (#2425647) --- .gitignore | 1 + harfbuzz.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 3bcd9fb..e13cb52 100644 --- a/.gitignore +++ b/.gitignore @@ -175,3 +175,4 @@ /harfbuzz-12.0.0.tar.xz /harfbuzz-12.1.0.tar.xz /harfbuzz-12.2.0.tar.xz +/harfbuzz-12.3.0.tar.xz diff --git a/harfbuzz.spec b/harfbuzz.spec index 0abd171..8f5f956 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,5 +1,5 @@ Name: harfbuzz -Version: 12.2.0 +Version: 12.3.0 Release: 1%{?dist} Summary: Text shaping library @@ -110,6 +110,9 @@ This package contains Harfbuzz Cairo support library. %{_libdir}/libharfbuzz-cairo.so.* %changelog +* Sun Dec 28 2025 Parag Nemade - 12.3.0-1 +- Update to 12.3.0 version (#2425647) + * Fri Nov 07 2025 Parag Nemade - 12.2.0-1 - Update to 12.2.0 version (#2412425) diff --git a/sources b/sources index 9b0fdfb..7199718 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (harfbuzz-12.2.0.tar.xz) = 7e7cd5dfdbf8848c3c078628f2cf355db6dcc938083fa7d2f69ab6f174041dc64fae1973f97a1649dfcf9f2bf143517329efb3f67ccfe8996eb84b6ff52f4029 +SHA512 (harfbuzz-12.3.0.tar.xz) = 7452379ee35b312cb83b5365e480dd2cc73813fa5eb489988ea7b02fa7e8137de66ea10ef71fcbbfb3275013247c46ede3f28ac9ef92c1213424ea0b0a077b03 From 7a21499d6c8740e1b9d420a99452125bf76b0023 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Tue, 13 Jan 2026 20:24:32 +0000 Subject: [PATCH 5/7] Backport security fix for CVE-2026-22693 (fix RHBZ#2429278) --- ...ff8d990284f04d8768f35b0e20ae5f60daae.patch | 25 +++++++++++++++++++ harfbuzz.spec | 10 ++++++++ 2 files changed, 35 insertions(+) create mode 100644 1265ff8d990284f04d8768f35b0e20ae5f60daae.patch diff --git a/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch b/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch new file mode 100644 index 0000000..81a02d6 --- /dev/null +++ b/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch @@ -0,0 +1,25 @@ +From 1265ff8d990284f04d8768f35b0e20ae5f60daae Mon Sep 17 00:00:00 2001 +From: Behdad Esfahbod +Date: Fri, 9 Jan 2026 04:54:42 -0700 +Subject: [PATCH] [cmap] malloc fail test (#5710) + +Fixes https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww +--- + src/hb-ot-cmap-table.hh | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/hb-ot-cmap-table.hh b/src/hb-ot-cmap-table.hh +index 32f705bb3c5..d08e66edaa2 100644 +--- a/src/hb-ot-cmap-table.hh ++++ b/src/hb-ot-cmap-table.hh +@@ -1670,6 +1670,10 @@ struct SubtableUnicodesCache { + { + SubtableUnicodesCache* cache = + (SubtableUnicodesCache*) hb_malloc (sizeof(SubtableUnicodesCache)); ++ ++ if (unlikely (!cache)) ++ return nullptr; ++ + new (cache) SubtableUnicodesCache (source_table); + return cache; + } diff --git a/harfbuzz.spec b/harfbuzz.spec index f100dfa..dfc0ec8 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -7,6 +7,16 @@ License: MIT-Modern-Variant URL: https://github.com/harfbuzz/harfbuzz/ Source0: https://github.com/harfbuzz/harfbuzz/releases/download/%{version}/harfbuzz-%{version}.tar.xz +# [cmap] malloc fail test (#5710) +# https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae +# +# Fixes: +# +# Null Pointer Dereference in SubtableUnicodesCache::create leading to DoS +# https://www.cve.org/CVERecord?id=CVE-2026-22693 +# https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww +Patch: https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae.patch + BuildRequires: cairo-devel BuildRequires: freetype-devel BuildRequires: glib2-devel From 2098470dff67ba1a026816bd76a0d06c992596ca Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Wed, 14 Jan 2026 17:50:28 +0530 Subject: [PATCH 6/7] Backport security fix for CVE-2026-22693 (fix RHBZ#2429278) --- harfbuzz.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/harfbuzz.spec b/harfbuzz.spec index dfc0ec8..76a49e3 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -1,6 +1,6 @@ Name: harfbuzz Version: 11.5.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Text shaping library License: MIT-Modern-Variant @@ -120,6 +120,9 @@ This package contains Harfbuzz Cairo support library. %{_libdir}/libharfbuzz-cairo.so.* %changelog +* Wed Jan 14 2026 Parag Nemade - 11.5.1-2 +- Backport security fix for CVE-2026-22693 (fix RHBZ#2429278) + * Tue Sep 23 2025 Parag Nemade - 11.5.1-1 - Update to 11.5.1 version (#2397450) From 2bf11dcc86b41a51d2b2d6e400850c0272b39015 Mon Sep 17 00:00:00 2001 From: Parag Nemade Date: Wed, 14 Jan 2026 17:52:58 +0530 Subject: [PATCH 7/7] Backport security fix for CVE-2026-22693 (fix RHBZ#2429288) --- harfbuzz.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/harfbuzz.spec b/harfbuzz.spec index 76a49e3..bb213da 100644 --- a/harfbuzz.spec +++ b/harfbuzz.spec @@ -121,7 +121,7 @@ This package contains Harfbuzz Cairo support library. %changelog * Wed Jan 14 2026 Parag Nemade - 11.5.1-2 -- Backport security fix for CVE-2026-22693 (fix RHBZ#2429278) +- Backport security fix for CVE-2026-22693 (fix RHBZ#2429288) * Tue Sep 23 2025 Parag Nemade - 11.5.1-1 - Update to 11.5.1 version (#2397450)