security/linux-rl9-ca-certificates: update to 2026.2.92_v9.0.319-90.3.el9_8
Changelog:
*Thu Oct 22 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.3
- Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch
*Thu Oct 22 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.2
- Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates
*Wed Oct 21 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.1
- Removing: AAA Certificate Services root CA
- Removing: emSign ECC Root CA - G3 from Microsoft Code Signing certificates
*Wed Oct 21 2026 Krenželok František <fkrenzel at redhat.com> - 2026.2.92_v9.0.319-90.0
- Update to CKBI 2.92_v9.0.319 from NSS 3.131.1
Removing:
- emSign Root CA - C1
Adding:
[38 lines not shown]
textproc/antiword: Deprecate
Upstream has been dead since the 0.37 release in 2005. The only
remaining fork (github.com/grobian/antiword) has no releases and does
not address security issues.
CVE-2026-111677 (heap out-of-bounds read in vGet8LstInfo) and
CVE-2026-111678 (stack out-of-bounds read in vGet8PapInfo and
vGet8ChrInfo) are unfixed upstream and in every distribution.
Set to expire on 2026-11-30.
Sponsored by: Netzkommune GmbH
(cherry picked from commit 100c915a873d51c284aa4febb506da8db7a3a440)
textproc/antiword: Deprecate
Upstream has been dead since the 0.37 release in 2005. The only
remaining fork (github.com/grobian/antiword) has no releases and does
not address security issues.
CVE-2026-111677 (heap out-of-bounds read in vGet8LstInfo) and
CVE-2026-111678 (stack out-of-bounds read in vGet8PapInfo and
vGet8ChrInfo) are unfixed upstream and in every distribution.
Set to expire on 2026-11-30.
Sponsored by: Netzkommune GmbH
www/py-django-extensions: Update 3.2.3 => 4.1
Changelog:
https://github.com/django-extensions/django-extensions/blob/4.1/CHANGELOG.md
Port changes:
- Switch to USE_PYTHON=pep517.
- Add concurrent to USE_PYTHON.
- Add mail/py-aiosmtpd to RUN_DEPENDS for mail_debug.
- Patch the PEP 639 license string for the setuptools in the tree.
- Fix portlint warnings.
PR: 299899
Approved by: Kevin Golding <ports at caomhin.org> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 1c5cc9c088aeb0d7f94c4ccab4ee0acf29d3839a)
[libclc] Fix exponent overflow and subnormal rounding in __clc_ldexp (#233823)
When fp32 subnormals are
supported (`!__clc_denormals_are_zero_fp32()`), `__clc_ldexp` previously
added `n` to the exponent with plain signed integer addition,
overflowing 32-bit `int` when `n` is near `INT_MAX` or `INT_MIN` (e.g.
`n = INT_MAX` wrapped around to `< -24` and flushed to zero instead of
returning infinity). Additionally, subnormal fp32 results were formed
with a truncating right shift instead of round-to-nearest-even, and
shift counts were not clamped to valid ranges.
Normalize subnormal fp32 inputs before adding `n`, use
`__clc_add_sat(exponent, n)` in both fp32 and fp64 `__clc_ldexp` to
prevent signed integer overflow, clamp shift counts, and apply
round-to-nearest-even when right-shifting into a subnormal fp32 result.
www/py-django-extensions: Update 3.2.3 => 4.1
Changelog:
https://github.com/django-extensions/django-extensions/blob/4.1/CHANGELOG.md
Port changes:
- Switch to USE_PYTHON=pep517.
- Add concurrent to USE_PYTHON.
- Add mail/py-aiosmtpd to RUN_DEPENDS for mail_debug.
- Patch the PEP 639 license string for the setuptools in the tree.
- Fix portlint warnings.
PR: 299899
Approved by: Kevin Golding <ports at caomhin.org> (maintainer)
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q4
[flang][cuda] Skip device-only specifics at host call sites in generic resolution (#234710)
When CUDA is enabled and the call site is not in a device context, skip
specifics whose only CUDA subprogram attribute is DEVICE. HOST,DEVICE
and
unattributed specifics are unaffected. Call sites inside CUF kernel and
OpenACC regions, which share Scope::Kind::OpenACCConstruct and may be
device code in a host subprogram, are left unfiltered.
[ELF] Reject invalid .eh_frame FDE encoding early in addCie (#235532)
The result does not depend on addresses. It's better than diagnosing it
in EhFrameHeader::updateAllocSize. Diagnose even if --eh-frame-hdr is
not specified.
[ELF] Report invalid .eh_frame CIE references when splitting (#235531)
An FDE with an invalid CIE pointer is diagnosed with Fatal in
EhFrameSection::addRecords, leading to main-run-twice issue. Diagnose in
EhInputSection::split like other malformed records, so that the CIE
index of an FDE is always valid.
linux: Implement PTRACE_GETREGSET NT_PRFPREG and NT_X86_XSTATE
Implement NT_PRFPREG and NT_X86_XSTATE for PTRACE_GETREGSET on amd64.
Chrome's crashpad handler uses these to collect floating-point and
extended CPU register state for crash dumps.
Other architectures retain the previous EINVAL stub behavior.
Signed-off-by: Ricardo Branco <rbranco at suse.de>
PR: 289285
Reviewed by: kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2165
(cherry picked from commit c515e6040614434a9262ee8b5ac54b81476ec7ff)
linux: Add linux_pt_fpregset and bsd_to_linux_fpregset() for amd64
Add struct linux_pt_fpregset, the amd64 Linux NT_PRFPREG payload,
corresponding to user_i387_struct in Linux. The struct describes
the 512-byte FXSAVE area as exposed by PTRACE_GETREGSET.
Add bsd_to_linux_fpregset() to translate from FreeBSD's struct fpreg
to struct linux_pt_fpregset. Fields are extracted from the fpr_env[]
array which stores the FXSAVE environment packed as four 64-bit words.
The FP and XMM register banks are bulk-copied as opaque byte arrays.
Signed-off-by: Ricardo Branco <rbranco at suse.de>
Reviewed by: kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2165
(cherry picked from commit b84d31ee74535a0026ff83f2a34c07b7557f9785)
linux: Ignore sigaction(2) flags SA_UNSUPPORTED and SA_EXPOSE_TAGBITS
SA_UNSUPPORTED was introduced in Linux 5.11 to probe support
for other flags such as SA_EXPOSE_TAGBITS, introduced
at the same time. Ignore both.
Signed-off-by: Ricardo Branco <rbranco at suse.de>
PR: 289285
Reviewed by: pouria, kib
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2163
(cherry picked from commit fdea83a5f63b881ade91c6cc9dfbf173137512c5)
[ELF] Fix out-of-bounds .eh_frame relocation to not overwrite the next output section (#235530)
lld/test/ELF/comdat-discarded-reloc.s intermittently fails under TSan:
OffsetGetter::get reports an error for an out-of-bounds .eh_frame
relocation and maps to output offset 0. If the link continues due to
--noinhibit-exec and .eh_frame has no pieces, the write extends past the
4-byte terminator into the next output section.
Return -1 to skip the relocation, like one in a dead piece.
Avoid the 'converted' temporaries
Apparently not necessary because the argument itself is an r-value
reference. Still dangerious because the caller does not control when the
collee moves it, but unrelated to this PR
