Описание
Security update for glibc
This update for glibc fixes the following issues:
- CVE-2026-6368: wordexp WRDE_APPEND rollback restores stale we_wordv, leading to invalid free in wordfree (bsc#1274726).
- CVE-2026-6791: wordexp: unbounded alloca (strndupa) in parse_tilde (bsc#1274723).
- CVE-2026-18374: overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19542: Fix out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277921).
- CVE-2026-80489: non-progress DoS in SHIFT_JISX0213 -> UCS-4 conversion state handling (bsc#1277922).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:4204-1
- E-Mail link for SUSE-SU-2026:4204-1
- SUSE Security Ratings
- SUSE Bug 1274723
- SUSE Bug 1274726
- SUSE Bug 1276946
- SUSE Bug 1277262
- SUSE Bug 1277921
- SUSE Bug 1277922
- SUSE CVE CVE-2026-18374 page
- SUSE CVE CVE-2026-19542 page
- SUSE CVE CVE-2026-6368 page
- SUSE CVE CVE-2026-6791 page
- SUSE CVE CVE-2026-77117 page
- SUSE CVE CVE-2026-80489 page
Описание
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.
Затронутые продукты
Ссылки
- CVE-2026-18374
- SUSE Bug 1277262
Описание
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.
Затронутые продукты
Ссылки
- CVE-2026-19542
- SUSE Bug 1276946
Описание
Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.
Затронутые продукты
Ссылки
- CVE-2026-6368
- SUSE Bug 1274726
Описание
When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.
Затронутые продукты
Ссылки
- CVE-2026-6791
- SUSE Bug 1274723
Описание
Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.
Затронутые продукты
Ссылки
- CVE-2026-77117
- SUSE Bug 1277921
Описание
Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.
Затронутые продукты
Ссылки
- CVE-2026-80489
- SUSE Bug 1277922