Описание
Security update for glibc
This update for glibc fixes the following issues:
Security fixes:
- CVE-2026-4437: incorrect DNS response parsing via crafted DNS server response (bsc#1260078).
- CVE-2026-4438: invalid DNS hostname returned via gethostbyaddr functions (bsc#1260082).
Other fixes:
- nss: Missing checks in __nss_configure_lookup, __nss_database_get (bsc#1258319).
Список пакетов
openSUSE Leap 16.0
cross-aarch64-glibc-devel-2.40-160000.4.1
cross-ppc64le-glibc-devel-2.40-160000.4.1
cross-riscv64-glibc-devel-2.40-160000.4.1
cross-s390x-glibc-devel-2.40-160000.4.1
glibc-2.40-160000.4.1
glibc-devel-2.40-160000.4.1
glibc-devel-static-2.40-160000.4.1
glibc-extra-2.40-160000.4.1
glibc-gconv-modules-extra-2.40-160000.4.1
glibc-html-2.40-160000.4.1
glibc-i18ndata-2.40-160000.4.1
glibc-info-2.40-160000.4.1
glibc-lang-2.40-160000.4.1
glibc-locale-2.40-160000.4.1
glibc-locale-base-2.40-160000.4.1
glibc-profile-2.40-160000.4.1
glibc-utils-2.40-160000.4.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1258319
- SUSE Bug 1260078
- SUSE Bug 1260082
- SUSE CVE CVE-2026-4437 page
- SUSE CVE CVE-2026-4438 page
Описание
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.
Затронутые продукты
openSUSE Leap 16.0:cross-aarch64-glibc-devel-2.40-160000.4.1
openSUSE Leap 16.0:cross-ppc64le-glibc-devel-2.40-160000.4.1
openSUSE Leap 16.0:cross-riscv64-glibc-devel-2.40-160000.4.1
openSUSE Leap 16.0:cross-s390x-glibc-devel-2.40-160000.4.1
Ссылки
- CVE-2026-4437
- SUSE Bug 1260078
Описание
Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.
Затронутые продукты
openSUSE Leap 16.0:cross-aarch64-glibc-devel-2.40-160000.4.1
openSUSE Leap 16.0:cross-ppc64le-glibc-devel-2.40-160000.4.1
openSUSE Leap 16.0:cross-riscv64-glibc-devel-2.40-160000.4.1
openSUSE Leap 16.0:cross-s390x-glibc-devel-2.40-160000.4.1
Ссылки
- CVE-2026-4438
- SUSE Bug 1260082
- SUSE Bug 1260333