Debian Glibc vulnerabilities

CVE-2026-4046 [HIGH] CVE-2026-4046: glibc - The iconv() function in the GNU C Library versions 2.43 and earlier may crash du... The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application. This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them. Scope: local b

CVE-2026-0915 [HIGH] CVE-2026-0915: glibc - Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that spec... Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.42-8) sid: resolved (fixed in 2.4

CVE-2026-4437 [HIGH] CVE-2026-4437: glibc - Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that sp... Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer. S

CVE-2026-0861 [HIGH] CVE-2026-0861: glibc - Passing too large an alignment to the memalign suite of functions (memalign, pos... Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able t

CVE-2026-4438 [MEDIUM] CVE-2026-4438: glibc - Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that sp... Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.42-14) sid: resolved (fixed

CVE-2026-3904 [MEDIUM] CVE-2026-3904: glibc - Calling NSS-backed functions that support caching via nscd may call the nscd cl... Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. The nscd client in the GNU C Library uses the memcmp function with inputs that may be concurre

CVE-2025-4802 [HIGH] CVE-2025-4802: glibc - Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Librar... Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo). Scope: local bookworm: resolved (fixed in 2.36-9+de

CVE-2025-15281 [HIGH] CVE-2025-15281: glibc - Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Lib... Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.42-11) sid: resolved (fixed in 2.42-11) trixie

CVE-2025-8058 [MEDIUM] CVE-2025-8058: glibc - The regcomp function in the GNU C library version from 2.4 to 2.41 is subject t... The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architec

CVE-2025-0395 [MEDIUM] CVE-2025-0395: glibc - When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it ... When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size. Scope: local bookworm: resolved (fixed in 2.36-9+deb12u10) bullseye: resolved (fixed in 2.31-13+deb11u12) forky:

CVE-2025-5702 [MEDIUM] CVE-2025-5702: glibc - The strcmp implementation optimized for the Power10 processor in the GNU C Libra... The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking t

CVE-2025-5745 [MEDIUM] CVE-2025-5745: glibc - The strncmp implementation optimized for the Power10 processor in the GNU C Libr... The strncmp implementation optimized for the Power10 processor in the GNU C Library version 2.40 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking

CVE-2025-0577 [MEDIUM] CVE-2025-0577: glibc - An insufficient entropy vulnerability was found in glibc. The getrandom and arc4... An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2024-33602 [HIGH] CVE-2024-33602: glibc - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Servi... nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Scope: local bookworm: resolved

CVE-2024-2961 [HIGH] CVE-2024-2961: glibc - The iconv() function in the GNU C Library versions 2.39 and older may overflow t... The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. Scope: local bookworm: resolved (fixed in 2.36-9+deb12u6) bullseye: resolved (fixed in 2.31-13+deb11u9)

CVE-2024-33599 [HIGH] CVE-2024-33599: glibc - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache D... nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Sco

CVE-2024-33601 [HIGH] CVE-2024-33601: glibc - nscd: netgroup cache may terminate daemon on memory allocation failure The Name... nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability

CVE-2024-33600 [MEDIUM] CVE-2024-33600: glibc - nscd: Null pointer crashes after notfound response If the Name Service Cache Da... nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary. Scope: local bookworm:

CVE-2024-12455 [LOW] CVE-2024-12455: glibc bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2023-6246 [HIGH] CVE-2023-6246: glibc - A heap-based buffer overflow was found in the __vsyslog_internal function of the... A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash