Описание
Security update for glibc
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure (bsc#1263658).
Список пакетов
Container bci/golang:1.25-openssl
Container bci/spack:latest
Container suse/ltss/sle15.6/bci-base-fips:latest
Container suse/ltss/sle15.6/sle15:latest
Container suse/postgres:16
Container suse/postgres:16.14
Container suse/postgres:17.10
Container suse/postgres:latest
SUSE Linux Enterprise Module for Basesystem 15 SP7
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3030-1
- E-Mail link for SUSE-SU-2026:3030-1
- SUSE Security Ratings
- SUSE Bug 1263656
- SUSE Bug 1263658
- SUSE CVE CVE-2026-5435 page
- SUSE CVE CVE-2026-6238 page
Описание
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
Затронутые продукты
Ссылки
- CVE-2026-5435
- SUSE Bug 1263656
Описание
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
Затронутые продукты
Ссылки
- CVE-2026-6238
- SUSE Bug 1263658