diff --git a/SPECS/cmake/CVE-2025-9301.patch b/SPECS/cmake/CVE-2025-9301.patch new file mode 100644 index 00000000000..db5a7183c28 --- /dev/null +++ b/SPECS/cmake/CVE-2025-9301.patch @@ -0,0 +1,65 @@ +From ea35709d0951b2c651df0372a4e96a7b437e3089 Mon Sep 17 00:00:00 2001 +From: Tyler Yankee +Date: Wed, 13 Aug 2025 15:22:28 -0400 +Subject: [PATCH] foreach: Explicitly skip replay without iterations + +As written, foreach loops with a trailing `IN` (i.e., no loop +variable(s) given) lead to an assertion error. Handle this case by +exiting early when we know the loop won't execute anything. + +Fixes: #27135 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8.patch +--- + Source/cmForEachCommand.cxx | 3 +++ + Tests/RunCMake/foreach/RunCMakeTest.cmake | 1 + + Tests/RunCMake/foreach/TrailingIn-result.txt | 1 + + Tests/RunCMake/foreach/TrailingIn.cmake | 5 +++++ + 4 files changed, 10 insertions(+) + create mode 100644 Tests/RunCMake/foreach/TrailingIn-result.txt + create mode 100644 Tests/RunCMake/foreach/TrailingIn.cmake + +diff --git a/Source/cmForEachCommand.cxx b/Source/cmForEachCommand.cxx +index 33dae79f..9b9a60b3 100644 +--- a/Source/cmForEachCommand.cxx ++++ b/Source/cmForEachCommand.cxx +@@ -101,6 +101,9 @@ bool cmForEachFunctionBlocker::ArgumentsMatch(cmListFileFunction const& lff, + bool cmForEachFunctionBlocker::Replay( + std::vector functions, cmExecutionStatus& inStatus) + { ++ if (this->Args.size() == this->IterationVarsCount) { ++ return true; ++ } + return this->ZipLists ? this->ReplayZipLists(functions, inStatus) + : this->ReplayItems(functions, inStatus); + } +diff --git a/Tests/RunCMake/foreach/RunCMakeTest.cmake b/Tests/RunCMake/foreach/RunCMakeTest.cmake +index 15ca4770..acfc742e 100644 +--- a/Tests/RunCMake/foreach/RunCMakeTest.cmake ++++ b/Tests/RunCMake/foreach/RunCMakeTest.cmake +@@ -22,3 +22,4 @@ run_cmake(foreach-RANGE-invalid-test) + run_cmake(foreach-RANGE-out-of-range-test) + run_cmake(foreach-var-scope-CMP0124-OLD) + run_cmake(foreach-var-scope-CMP0124-NEW) ++run_cmake(TrailingIn) +diff --git a/Tests/RunCMake/foreach/TrailingIn-result.txt b/Tests/RunCMake/foreach/TrailingIn-result.txt +new file mode 100644 +index 00000000..573541ac +--- /dev/null ++++ b/Tests/RunCMake/foreach/TrailingIn-result.txt +@@ -0,0 +1 @@ ++0 +diff --git a/Tests/RunCMake/foreach/TrailingIn.cmake b/Tests/RunCMake/foreach/TrailingIn.cmake +new file mode 100644 +index 00000000..e2b5b2f2 +--- /dev/null ++++ b/Tests/RunCMake/foreach/TrailingIn.cmake +@@ -0,0 +1,5 @@ ++foreach(v IN) ++endforeach() ++ ++foreach(v1 v2 IN) ++endforeach() +-- +2.45.4 + diff --git a/SPECS/cmake/cmake.spec b/SPECS/cmake/cmake.spec index aa8ef76182e..c0716bbea53 100644 --- a/SPECS/cmake/cmake.spec +++ b/SPECS/cmake/cmake.spec @@ -2,7 +2,7 @@ Summary: Cmake Name: cmake Version: 3.30.3 -Release: 8%{?dist} +Release: 9%{?dist} License: BSD AND LGPLv2+ Vendor: Microsoft Corporation Distribution: Azure Linux @@ -30,6 +30,7 @@ Patch10: CVE-2025-4947.patch Patch11: CVE-2025-5916.patch Patch12: CVE-2025-5917.patch Patch13: CVE-2025-5918.patch +Patch14: CVE-2025-9301.patch BuildRequires: bzip2 BuildRequires: bzip2-devel @@ -110,6 +111,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure %{_libdir}/rpm/macros.d/macros.cmake %changelog +* Fri Aug 22 2025 Azure Linux Security Servicing Account - 3.30.3-9 +- Patch for CVE-2025-9301 + * Tue Jun 24 2025 Durga Jagadeesh Palli - 3.30.3-8 - Patch CVE-2025-5916, CVE-2025-5917 & CVE-2025-5918 diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 77ceafcc610..f178408cdca 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -51,8 +51,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm chkconfig-1.25-1.azl3.aarch64.rpm chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm chkconfig-lang-1.25-1.azl3.aarch64.rpm -cmake-3.30.3-8.azl3.aarch64.rpm -cmake-debuginfo-3.30.3-8.azl3.aarch64.rpm +cmake-3.30.3-9.azl3.aarch64.rpm +cmake-debuginfo-3.30.3-9.azl3.aarch64.rpm coreutils-9.4-6.azl3.aarch64.rpm coreutils-debuginfo-9.4-6.azl3.aarch64.rpm coreutils-lang-9.4-6.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index eb369b25b21..9a96d4594e3 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -54,8 +54,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm chkconfig-1.25-1.azl3.x86_64.rpm chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm chkconfig-lang-1.25-1.azl3.x86_64.rpm -cmake-3.30.3-8.azl3.x86_64.rpm -cmake-debuginfo-3.30.3-8.azl3.x86_64.rpm +cmake-3.30.3-9.azl3.x86_64.rpm +cmake-debuginfo-3.30.3-9.azl3.x86_64.rpm coreutils-9.4-6.azl3.x86_64.rpm coreutils-debuginfo-9.4-6.azl3.x86_64.rpm coreutils-lang-9.4-6.azl3.x86_64.rpm