SUSE-SU-2026:23929-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2026:23929-1

Upstream

CVE (9)

Related

CVE (9)

Published

2026-09-29T11:23:34Z

Modified

2026-10-02T18:23:09Z

Summary

Security update for glibc

Details

This update for glibc fixes the following issues:

CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
CVE-2026-8674: reachable assert in resolv/resolv_conf.c:update_from_conf allows an attacker in a local network to trigger a process crash (bsc#1281297).
CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).

Other changes:

Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40-160000.7.1

{
    "binaries":  [
        {
            "glibc-gconv-modules-extra":  "2.40-160000.7.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23929-1.json"