USN-8737-2: GNU C Library vulnerabilities
Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.
USN-8737-2 provides the Ubuntu 24.04 LTS counterpart to fixes released in USN-8737-1 for GNU C Library vulnerabilities. CVE-2026-19499 is a buffer overflow in strfmon when handling right-justification padding, potentially allowing denial of service or arbitrary code execution on Ubuntu 26.04 LTS. CVE-2026-19542 is an out-of-bounds stack array access in tdelete that could also result in denial of service or code execution.
- CVE-2026-19499: strfmon buffer overflow via right-justification padding
- CVE-2026-19542: out-of-bounds stack access in tdelete
- Both flaws may enable denial of service or arbitrary code execution
- Update delivers the original glibc fixes to Ubuntu 24.04 LTS
- Products
- GNU C Librarystrfmontdelete
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-19499+1 related CVE | Buffer overflow in glibc strfmon() width padding affects glibc 2.38–2.44 | 7.7 group max | — |
From the original article
USN-8737-1 fixed vulnerabilities in GNU C Library. This update provides the corresponding fixes for Ubuntu 24. 04 LTS.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.