glibc 2.2–2.44 wide scanf writes one byte past buffer
GLIBC-SA-2026-0027 says %s and %[ without the l modifier add an extra null in wide scanf conversions.
Stories per day · 30 days
2 RSS
Relatedbig-hkscs1buffer-overflow1c1clang1c-library1directory-traversal1environment-variable1gcc1getaddrinfo1gettext1idna1language-standards1linux1musl1resolver1scanf1
13 stories, newest first · one card per story
Stories tagged #glibc
glibc getaddrinfo accepts Unicode lookalike IPv4 addresses
glibc's getaddrinfo accepts Unicode characters that map to digits and dots, allowing many non-standard representations of the same IPv4 address to resolve to the same IP.
1
GNU C Library BIG-HKSCS decoding hang on crafted input
The flaw affects GNU C Library versions 2.18 through 2.31 and may cause the converter to hang on crafted BIG-HKSCS input.
glibc gettext allows directory traversal via LANGUAGE
The issue affects GNU C Library 2.0 and later, except setuid or setgid programs marked AT_SECURE.
The GNU C Library security advisory update for 2026-09-28
GNU C Library Power8 strncasecmp can overread one byte and crash when inputs are attacker-controlled.
Dissecting House of Apple 2 on modern glibc
Walkthrough shows House of Apple 2 still hijacks glibc 2.43 file streams through an unchecked wide-character vtable.
7
The GNU C Library security advisories update for 2026-09-22
A glibc ld.so TOCTOU lets local attackers load code via $ORIGIN in setuid programs.
The GNU C Library security advisories update for 2026-09-17
GNU C Library advisory describes a DNS stub resolver assertion failure that aborts processes when search domains reach roughly 200 characters in glibc 2.26-2.44.
The GNU C Library security advisories update for 2026-09-14
glibc advisory GLIBC-SA-2026-0017 discloses a buffer overflow in strfmon/strfmon_l affecting versions 2.38 through 2.44.
Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages
Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.
The GNU C Library security advisory update for 2026-09-10
glibc advisory GLIBC-SA-2026-0016: nscd can crash from a stack overflow when an untrusted DNS server returns oversized responses.
USN-8737-2: GNU C Library vulnerabilities
Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.
USN-8737-1: GNU C Library vulnerabilities
Ubuntu patches GNU C Library flaws including a strfmon buffer overflow and tdelete out-of-bounds access that could enable code execution.