CLSA-2026-1784210930
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1784210930.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1784210930
- Upstream
- Published
- 2026-07-16T14:09:17Z
- Modified
- 2026-10-26T09:31:47Z
- Summary
- Fix CVE(s): CVE-2026-58469, CVE-2026-58471, CVE-2026-58472
- Details
-
- SECURITY UPDATE: heap buffer under-read in clean_metalink_string()
- debian/patches/CVE-2026-58469.patch: bound the backward whitespace scan with end > beg in src/metalink.c so an all-whitespace Metalink URL cannot read before the start of the buffer
- CVE-2026-58469
- SECURITY UPDATE: heap buffer overflow in convert_fname()
- debian/patches/CVE-2026-58471.patch: correctly track used and remaining space across the iconv E2BIG reallocation in src/url.c so the output buffer is not overflowed
- CVE-2026-58471
- SECURITY UPDATE: integer and heap buffer overflow in html_quote_string()
- debian/patches/CVE-2026-58472.patch: size the quoted string using overflow-checked accumulation (size_t with INT_ADD_WRAPV) in src/convert.c and abort on overflow instead of under-allocating
- CVE-2026-58472
- SECURITY UPDATE: heap buffer under-read in clean_metalink_string()
- References