OESA-2026-3618

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3618
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3618.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3618
Upstream
  • CVE-2026-19499
  • CVE-2026-77117
  • CVE-2026-80489
Published
2026-09-05T15:03:12Z
Modified
2026-09-05T15:16:22.861514902Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H CVSS Calculator
Summary
glibc security update
Details

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more.

Security Fix(es):

A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499)

A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)

A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS-SP3 / glibc

Package

Name
glibc
Purl
pkg:rpm/openEuler/glibc&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.38-124.oe2403sp3

Ecosystem specific 

{
    "src": [
        "glibc-2.38-124.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "glibc-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-all-langpacks-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-common-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-debuginfo-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-debugsource-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-debugutils-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-devel-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-locale-archive-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-locale-source-2.38-124.oe2403sp3.x86_64.rpm",
        "glibc-nss-devel-2.38-124.oe2403sp3.x86_64.rpm",
        "libnsl-2.38-124.oe2403sp3.x86_64.rpm",
        "nscd-2.38-124.oe2403sp3.x86_64.rpm",
        "nss_modules-2.38-124.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "glibc-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-all-langpacks-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-common-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-debuginfo-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-debugsource-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-debugutils-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-devel-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-locale-archive-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-locale-source-2.38-124.oe2403sp3.aarch64.rpm",
        "glibc-nss-devel-2.38-124.oe2403sp3.aarch64.rpm",
        "libnsl-2.38-124.oe2403sp3.aarch64.rpm",
        "nscd-2.38-124.oe2403sp3.aarch64.rpm",
        "nss_modules-2.38-124.oe2403sp3.aarch64.rpm"
    ],
    "noarch": [
        "glibc-help-2.38-124.oe2403sp3.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3618.json"