qiurui/glibc
1
0
Fork 0
mirror of git://sourceware.org/git/glibc.git synced 2026-09-08 23:58:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

Document CVE-2026-5358 and CVE-2026-5928

Browse Source 
Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
This commit is contained in:
Siddhesh Poyarekar
2026-04-20 16:21:46 -04:00
parent 2ff2565df7
commit da3863e62e
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/GLIBC-SA-2026-0008
+16
View File
@@ -0,0 +1,16 @@
Static buffer overflow in deprecated nis_local_principal
The obsolete nis_local_principal function in the GNU C Library version
2.43 and older may overflow a buffer in the data section, which could
allow an attacker to spoof a crafted response to a UDP request generated
by this function and overwrite neighboring static data in the requesting
application.
NIS support is obsolete and has been deprecated in the GNU C Library
since version 2.26 and is only maintained for legacy usage. Applications
should port away from NIS to more modern identity and access management
services.
CVE-Id: CVE-2026-5358
Public-Date: 2026-04-10
Reported-by: Rahul Hoysala
advisories/GLIBC-SA-2026-0010
+24
View File
@@ -0,0 +1,24 @@
Potential buffer under-read in ungetwc
Calling the ungetwc function on a FILE stream with wide characters
encoded in a character set that has overlaps between its single byte and
multi-byte character encodings, in the GNU C Library version 2.43 or
earlier, may result in an attempt to read bytes before an allocated
buffer, potentially resulting in unintentional disclosure of neighboring
data in the heap, or a program crash.
A bug in the wide character pushback implementation
(_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate
on the regular character buffer (fp->_IO_read_ptr) instead of the actual
wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program
crash may happen in cases where fp->_IO_read_ptr is not initialized and
hence points to NULL. The buffer under-read requires a special situation
where the input character encoding is such that there are overlaps
between single byte representations and multibyte representations in
that encoding, resulting in spurious matches. The spurious match case
is not possible in the standard Unicode character sets.
CVE-Id: CVE-2026-5928
Public-Date: 2026-03-17
Reported-by: Rocket Ma
Vulnerable-Commit: d64b6ad07585b8a37e5fecc9a47fcee766d52ede (2.1.1-89)