openSUSE-SU-2026:21968-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21968-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21968-1
- Upstream
- Related
- Published
- 2026-09-29T12:13:52Z
- Modified
- 2026-10-01T18:23:09Z
- Summary
- Security update for glibc
- Details
-
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in
resolv/resolv_conf.c:update_from_confallows an attacker in a local network to trigger a process crash (bsc#1281297). - CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges (bsc#1282509).
Other changes:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).
- References
-
- https://bugzilla.suse.com/1274723
- https://bugzilla.suse.com/1274726
- https://bugzilla.suse.com/1276892
- https://bugzilla.suse.com/1276946
- https://bugzilla.suse.com/1277247
- https://bugzilla.suse.com/1277262
- https://bugzilla.suse.com/1277921
- https://bugzilla.suse.com/1277922
- https://bugzilla.suse.com/1281297
- https://bugzilla.suse.com/1282509
- https://www.suse.com/security/cve/CVE-2026-18374
- https://www.suse.com/security/cve/CVE-2026-19499
- https://www.suse.com/security/cve/CVE-2026-19542
- https://www.suse.com/security/cve/CVE-2026-6368
- https://www.suse.com/security/cve/CVE-2026-6791
- https://www.suse.com/security/cve/CVE-2026-77117
- https://www.suse.com/security/cve/CVE-2026-80489
- https://www.suse.com/security/cve/CVE-2026-8674
- https://www.suse.com/security/cve/CVE-2026-86805
Affected packages
openSUSE:Leap 16.0 / glibc
Package
- Name
- glibc
- Purl
- pkg:rpm/opensuse/glibc&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.40-160000.7.1
Ecosystem specific
{
"binaries": [
{
"cross-aarch64-glibc-devel": "2.40-160000.7.1",
"cross-ppc64le-glibc-devel": "2.40-160000.7.1",
"cross-riscv64-glibc-devel": "2.40-160000.7.1",
"cross-s390x-glibc-devel": "2.40-160000.7.1",
"glibc": "2.40-160000.7.1",
"glibc-devel": "2.40-160000.7.1",
"glibc-devel-static": "2.40-160000.7.1",
"glibc-extra": "2.40-160000.7.1",
"glibc-gconv-modules-extra": "2.40-160000.7.1",
"glibc-html": "2.40-160000.7.1",
"glibc-i18ndata": "2.40-160000.7.1",
"glibc-info": "2.40-160000.7.1",
"glibc-lang": "2.40-160000.7.1",
"glibc-locale": "2.40-160000.7.1",
"glibc-locale-base": "2.40-160000.7.1",
"glibc-profile": "2.40-160000.7.1",
"glibc-utils": "2.40-160000.7.1"
}
]
}
openSUSE:Leap 16.0 / glibc-cross-aarch64-src
Package
- Name
- glibc-cross-aarch64-src
- Purl
- pkg:rpm/opensuse/glibc-cross-aarch64-src&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.40-160000.7.1
Ecosystem specific
{
"binaries": [
{
"cross-aarch64-glibc-devel": "2.40-160000.7.1",
"cross-ppc64le-glibc-devel": "2.40-160000.7.1",
"cross-riscv64-glibc-devel": "2.40-160000.7.1",
"cross-s390x-glibc-devel": "2.40-160000.7.1",
"glibc": "2.40-160000.7.1",
"glibc-devel": "2.40-160000.7.1",
"glibc-devel-static": "2.40-160000.7.1",
"glibc-extra": "2.40-160000.7.1",
"glibc-gconv-modules-extra": "2.40-160000.7.1",
"glibc-html": "2.40-160000.7.1",
"glibc-i18ndata": "2.40-160000.7.1",
"glibc-info": "2.40-160000.7.1",
"glibc-lang": "2.40-160000.7.1",
"glibc-locale": "2.40-160000.7.1",
"glibc-locale-base": "2.40-160000.7.1",
"glibc-profile": "2.40-160000.7.1",
"glibc-utils": "2.40-160000.7.1"
}
]
}
openSUSE:Leap 16.0 / glibc-cross-ppc64le-src
Package
- Name
- glibc-cross-ppc64le-src
- Purl
- pkg:rpm/opensuse/glibc-cross-ppc64le-src&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.40-160000.7.1
Ecosystem specific
{
"binaries": [
{
"cross-aarch64-glibc-devel": "2.40-160000.7.1",
"cross-ppc64le-glibc-devel": "2.40-160000.7.1",
"cross-riscv64-glibc-devel": "2.40-160000.7.1",
"cross-s390x-glibc-devel": "2.40-160000.7.1",
"glibc": "2.40-160000.7.1",
"glibc-devel": "2.40-160000.7.1",
"glibc-devel-static": "2.40-160000.7.1",
"glibc-extra": "2.40-160000.7.1",
"glibc-gconv-modules-extra": "2.40-160000.7.1",
"glibc-html": "2.40-160000.7.1",
"glibc-i18ndata": "2.40-160000.7.1",
"glibc-info": "2.40-160000.7.1",
"glibc-lang": "2.40-160000.7.1",
"glibc-locale": "2.40-160000.7.1",
"glibc-locale-base": "2.40-160000.7.1",
"glibc-profile": "2.40-160000.7.1",
"glibc-utils": "2.40-160000.7.1"
}
]
}
openSUSE:Leap 16.0 / glibc-cross-riscv64-src
Package
- Name
- glibc-cross-riscv64-src
- Purl
- pkg:rpm/opensuse/glibc-cross-riscv64-src&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.40-160000.7.1
Ecosystem specific
{
"binaries": [
{
"cross-aarch64-glibc-devel": "2.40-160000.7.1",
"cross-ppc64le-glibc-devel": "2.40-160000.7.1",
"cross-riscv64-glibc-devel": "2.40-160000.7.1",
"cross-s390x-glibc-devel": "2.40-160000.7.1",
"glibc": "2.40-160000.7.1",
"glibc-devel": "2.40-160000.7.1",
"glibc-devel-static": "2.40-160000.7.1",
"glibc-extra": "2.40-160000.7.1",
"glibc-gconv-modules-extra": "2.40-160000.7.1",
"glibc-html": "2.40-160000.7.1",
"glibc-i18ndata": "2.40-160000.7.1",
"glibc-info": "2.40-160000.7.1",
"glibc-lang": "2.40-160000.7.1",
"glibc-locale": "2.40-160000.7.1",
"glibc-locale-base": "2.40-160000.7.1",
"glibc-profile": "2.40-160000.7.1",
"glibc-utils": "2.40-160000.7.1"
}
]
}
openSUSE:Leap 16.0 / glibc-cross-s390x-src
Package
- Name
- glibc-cross-s390x-src
- Purl
- pkg:rpm/opensuse/glibc-cross-s390x-src&distro=openSUSE%20Leap%2016.0
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.40-160000.7.1
Ecosystem specific
{
"binaries": [
{
"cross-aarch64-glibc-devel": "2.40-160000.7.1",
"cross-ppc64le-glibc-devel": "2.40-160000.7.1",
"cross-riscv64-glibc-devel": "2.40-160000.7.1",
"cross-s390x-glibc-devel": "2.40-160000.7.1",
"glibc": "2.40-160000.7.1",
"glibc-devel": "2.40-160000.7.1",
"glibc-devel-static": "2.40-160000.7.1",
"glibc-extra": "2.40-160000.7.1",
"glibc-gconv-modules-extra": "2.40-160000.7.1",
"glibc-html": "2.40-160000.7.1",
"glibc-i18ndata": "2.40-160000.7.1",
"glibc-info": "2.40-160000.7.1",
"glibc-lang": "2.40-160000.7.1",
"glibc-locale": "2.40-160000.7.1",
"glibc-locale-base": "2.40-160000.7.1",
"glibc-profile": "2.40-160000.7.1",
"glibc-utils": "2.40-160000.7.1"
}
]
}