Source: glibc
Version: 2.42-15
Severity: important
Tags: security upstream
Forwarded: https://sourceware.org/bugzilla/show_bug.cgi?id=34033
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 2.41-12
Control: found -1 2.41-12+deb13u2
Control: found -1 2.36-9
Control: found -1 2.36-9+deb12u13

Hi,

The following vulnerability was published for glibc. Filling mainly
for tracking.

CVE-2026-5435[0]:
| The deprecated functions ns_printrrf, ns_printrr and fp_nquery in
| the GNU C Library version 2.2 and newer fail to enforce the caller-
| supplied buffer length, and can result in an out-of-bounds write
| when printing TSIG records.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-5435
https://www.cve.org/CVERecord?id=CVE-2026-5435
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=34033
[2] https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011

Regards,
Salvatore

Hello,

Bug #1135230 in glibc reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/glibc-team/glibc/-/commit/f169111821cad1148a05c3149edcacb73f41e43a
------------------------------------------------------------------------
debian/patches/git-updates.diff: update from upstream stable branch:

* debian/patches/git-updates.diff: update from upstream stable branch:
  - Fix a buffer overread in ns_sprintrrf with corrupted RDATA field
    (CVE-2026-6238).  Closes: #1135231.
  - Fix an out-of-bounds write in ns_sprintrrf when printing TSIG records
    (CVE-2026-5435).  Closes: #1135230.
  - Fix stack overflow in wordexp tilde expansion (CVE-2026-6791).
  - Cache cpuid results in ld.so for Intel CPUs.
  - Restore optimized memchr for POWER10.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1135230

Hello,

Bug #1135230 in glibc reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/glibc-team/glibc/-/commit/f169111821cad1148a05c3149edcacb73f41e43a
------------------------------------------------------------------------
debian/patches/git-updates.diff: update from upstream stable branch:

* debian/patches/git-updates.diff: update from upstream stable branch:
  - Fix a buffer overread in ns_sprintrrf with corrupted RDATA field
    (CVE-2026-6238).  Closes: #1135231.
  - Fix an out-of-bounds write in ns_sprintrrf when printing TSIG records
    (CVE-2026-5435).  Closes: #1135230.
  - Fix stack overflow in wordexp tilde expansion (CVE-2026-6791).
  - Cache cpuid results in ld.so for Intel CPUs.
  - Restore optimized memchr for POWER10.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1135230

We believe that the bug you reported is fixed in the latest version of
glibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135230@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated glibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 10 Aug 2026 14:19:03 +0200
Source: glibc
Architecture: source
Version: 2.43-3
Distribution: unstable
Urgency: medium
Maintainer: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Closes: 1135230 1135231
Changes:
 glibc (2.43-3) unstable; urgency=medium
 .
   [ Samuel Thibault ]
   * debian/testsuite-xfail-debian.mk: Update hurd results.
   * debian/patches/hurd-i386/submitted-path_mounted.diff: Renamed to
     git-path_mounted.diff.
 .
   [ Aurelien Jarno ]
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - debian/patches/hurd-i386/local-disable-ioctls.diff: rebased.
     - debian/patches/hurd-i386/submitted-AF_LINK.diff: upstreamed.
     - debian/patches/hurd-i386/submitted-AF_ROUTE.diff: upstreamed.
     - Fix a buffer overread in ns_sprintrrf with corrupted RDATA field
       (CVE-2026-6238).  Closes: #1135231.
     - Fix an out-of-bounds write in ns_sprintrrf when printing TSIG records
       (CVE-2026-5435).  Closes: #1135230.
     - Fix stack overflow in wordexp tilde expansion (CVE-2026-6791).
     - Cache cpuid results in ld.so for Intel CPUs.
     - Restore optimized memchr for POWER10.
   * debian/control.in/libc, debian/rules.d/debhelper.mk: drop the libc6-dev
     dependency on rpcsvc-proto.
   * debian/watch: set Git-Mode to shallow.
Checksums-Sha1:
 f3350d9c0a75462395929125eb3594be653febc4 8571 glibc_2.43-3.dsc
 d72782636b9ef765895fa28fd9f1056c9cf6bc8b 479456 glibc_2.43-3.debian.tar.xz
 61b194bc811152ac0b89d27c3898759cdfdf96bd 9529 glibc_2.43-3_source.buildinfo
Checksums-Sha256:
 256b1d37ce7a0e46e40f70b9faba73e4130bcf737eba2f9f8a966e0b268485db 8571 glibc_2.43-3.dsc
 f0163ed968b7e9e935833dc2e0478bb6bcf6d772ff2879f14b4c14115eedfb84 479456 glibc_2.43-3.debian.tar.xz
 eb4a01d9ea4e24d892dee2e4bccbc8ad1f58b827efedbfc9c7e22a76c30893bf 9529 glibc_2.43-3_source.buildinfo
Files:
 04ba19527762484383c06d5aa45adfaa 8571 libs required glibc_2.43-3.dsc
 35eaff73603a66441a469b644f41cb2f 479456 libs required glibc_2.43-3.debian.tar.xz
 74ff9c1093798f88180e132938ab64ae 9529 libs required glibc_2.43-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUryGlb40+QrX1Ay4E4jA+JnoM2sFAmp5wtsACgkQE4jA+Jno
M2teHg//f/bux+rbHTdkFgCHQSwBAYhHljyscftGamSGqarbjvcGJ/v+m1G+XGQk
mcOjRMz48QB9IB++2ZqKlywIpFyKJrFufUqwnSkSeVP5+sUYn6kbhmpXGk79S9Xd
o15+0LbmGU2s1MXPYAP5nwDrAr9Isre8e0GojLQRNXW0jbcg9jCTNA1vaoNOECNg
3oEjFNv6JADCaPvWjyIaZNn0e7hV+E7DeAaMqY87NWbFysIZl2M4K59G4QV5B5he
DUdFCvlLjT7XXD2Ysy+MrdHpdx82vu2rN+wLmhBxvaQZ4lR9EkmtFqeQcOsDVd17
iOwwK9hGdERWRMo06BI/VzaMNGBA7SoFYXH8LPgLRF+Tazy4ObLIZRtwBWUP4qAt
y0uK5BhaMCAC4iLALBSDHNRsUvou3XMV8VAJOHLPVmA5kgjnw6hN1rPKITe7nNrA
uilL6A3aaogP+A0yE1RGnvUOIapgFSmIqPKEugjenf9pUfbZHE7hiFx2a4Th2vtS
osmXu//XFjYdRVZ+acq7XqG3bbUHaMiOc4ecl128JIrxdBKY6oHO28dCLl2/JoaV
PmltWkknAz7Yoalg8F7mTKZKLXcHp9fg7BLrkhubkoZUF51uHHOwJWdWND9hdEyg
bT1HE11rI9491x8W66GTavkiyvBoaZh7h+AM+2W1djywujMfv1M=
=Z7Tl
-----END PGP SIGNATURE-----