Описание
Security update for glibc
This update for glibc fixes the following issues:
- CVE-2026-0915: resolv: Fix NSS DNS backend for getnetbyaddr (bsc#1256822, BZ #33802)
- CVE-2025-15281: posix: Reset wordexp_t fields with WRDE_REUSE (bsc#1257005, BZ #33814)
- CVE-2025-8058: posix: Fix double-free after allocation failure in regcomp (bsc#1246965, BZ #33185)
Список пакетов
Container suse/ltss/sle12.5/sles12sp5:latest
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:0680-1
- E-Mail link for SUSE-SU-2026:0680-1
- SUSE Security Ratings
- SUSE Bug 1246965
- SUSE Bug 1256822
- SUSE Bug 1257005
- SUSE CVE CVE-2025-15281 page
- SUSE CVE CVE-2025-8058 page
- SUSE CVE CVE-2026-0915 page
Описание
Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
Затронутые продукты
Ссылки
- CVE-2025-15281
- SUSE Bug 1257005
Описание
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
Затронутые продукты
Ссылки
- CVE-2025-8058
- SUSE Bug 1246965
Описание
Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.
Затронутые продукты
Ссылки
- CVE-2026-0915
- SUSE Bug 1256822