mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 00:20:38 -09:00
509daa69c0
Fixes the following vulnerabilities:
- CVE-2026-4046:
The iconv() function in the GNU C Library versions 2.43 and earlier
may crash due to an assertion failure when converting inputs from the
IBM1390 or IBM1399 character sets, which may be used to remotely crash
an application. This vulnerability can be trivially mitigated by
removing the IBM1390 and IBM1399 character sets from systems that do
not need them.
For more information, see:
- glibc-2.42-62-gf13c1bb0f97fbc12a6ba1ab5669ce561ea32b80a
- https://www.cve.org/CVERecord?id=CVE-2026-4046
- CVE-2026-4437:
Calling gethostbyaddr or gethostbyaddr_r with a configured
nsswitch.conf that specifies the library's DNS backend in the GNU C
Library version 2.34 to version 2.43 could, with a crafted response
from the configured DNS server, result in a violation of the DNS
specification that causes the application to treat a non-answer
section of the DNS response as a valid answer.
For more information, see:
- glibc-2.42-58-g8e863fb1c92360520704a69dc948be6bb4a17cb3
- https://www.cve.org/CVERecord?id=CVE-2026-4437
- CVE-2026-4438:
Calling gethostbyaddr or gethostbyaddr_r with a configured
nsswitch.conf that specifies the library's DNS backend in the GNU C
library version 2.34 to version 2.43 could result in an invalid DNS
hostname being returned to the caller in violation of the DNS
specification.
For more information, see:
- glibc-2.42-59-g426378547e6ddead92f28f5558a124eb0821d2f9
- https://www.cve.org/CVERecord?id=CVE-2026-4438
- CVE-2026-5450:
Calling the scanf family of functions with a %mc (malloc'd character
match) in the GNU C Library version 2.7 to version 2.43 with a format
width specifier with an explicit width greater than 1024 could result
in a one byte heap buffer overflow.
For more information, see:
- glibc-2.42-67-g4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc
- https://www.cve.org/CVERecord?id=CVE-2026-5450
- CVE-2026-5928:
Calling the ungetwc function on a FILE stream with wide characters
encoded in a character set that has overlaps between its single byte
and multi-byte character encodings, in the GNU C Library version 2.43
or earlier, may result in an attempt to read bytes before an allocated
buffer, potentially resulting in unintentional disclosure of
neighboring data in the heap, or a program crash. A bug in the wide
character pushback implementation (_IO_wdefault_pbackfail in
libio/wgenops.c) causes ungetwc() to operate on the regular character
buffer (fp->_IO_read_ptr) instead of the actual wide-stream read
pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen
in cases where fp->_IO_read_ptr is not initialized and hence points to
NULL. The buffer under-read requires a special situation where the
input character encoding is such that there are overlaps between
single byte representations and multibyte representations in that
encoding, resulting in spurious matches. The spurious match case is
not possible in the standard Unicode character sets.
For more information, see:
- glibc-2.42-66-gb4bca35ab9e76890504c4dbdd5eaf15a93514580
- https://www.cve.org/CVERecord?id=CVE-2026-5928
> git shortlog 2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125..2.42-67-g4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc
Carlos O'Donell (2):
resolv: Count records correctly (CVE-2026-4437)
resolv: Check hostname for validity (CVE-2026-4438)
DJ Delorie (1):
include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
Florian Weimer (8):
Switch currency symbol for the bg_BG locale to euro
nss: Introduce dedicated struct nss_database_for_fork type
Linux: In getlogin_r, use utmp fallback only for specific errors
nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940)
iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module
posix: Run tst-wordexp-reuse-mem test
Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
H.J. Lu (1):
abilist.awk: Handle weak unversioned defined symbols
Michael Jeanson (1):
tests: fix tst-rseq with Linux 7.0
Rocket Ma (2):
libio: Fix ungetwc operating on byte stream [BZ #33998]
stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
Xi Ruoyao (1):
elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
(cherry picked from commit e3c662eac9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>