mbox series

[0/5] Fixes for CVE-2026-5435, CVE-2026-6238

Message ID cover.1777546194.git.fweimer@redhat.com (mailing list archive)
Headers
Series Fixes for CVE-2026-5435, CVE-2026-6238 |

Message

Florian Weimer April 30, 2026, 10:51 a.m. UTC 
  CVE-2026-6238 has multiple vulnerable commits across different glibc
versions.  Technically, this means the CVE ID should be SPLIT.  I'm not
sure if this is worthwhile because I doubt people care about glibc
before version 2.7.

Thanks,
Florian

Florian Weimer (5):
  Update GLIBC-SA-2026-0012 to mention A6 records
  resolv: Check for inet_ntop failure in ns_sprintrrf
  resolv: Remove incorrect parts of TSIG handling from ns_sprintrrf
    (CVE-2026-5435)
  resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
  resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)

 advisories/GLIBC-SA-2026-0012 |   4 +-
 resolv/Makefile               |   2 +
 resolv/ns_print.c             |  46 ++---
 resolv/tst-ns_sprintrr.c      | 322 ++++++++++++++++++++++++++++++++++
 4 files changed, 352 insertions(+), 22 deletions(-)
 create mode 100644 resolv/tst-ns_sprintrr.c


base-commit: dbc2b380fac027fed5db6ae864e4accf9f82a3fd

Comments

Florian Weimer June 8, 2026, 11 a.m. UTC | #1 
* Florian Weimer:

> CVE-2026-6238 has multiple vulnerable commits across different glibc
> versions.  Technically, this means the CVE ID should be SPLIT.  I'm not
> sure if this is worthwhile because I doubt people care about glibc
> before version 2.7.
>
> Thanks,
> Florian
>
> Florian Weimer (5):
>   Update GLIBC-SA-2026-0012 to mention A6 records
>   resolv: Check for inet_ntop failure in ns_sprintrrf
>   resolv: Remove incorrect parts of TSIG handling from ns_sprintrrf
>     (CVE-2026-5435)
>   resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
>   resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
>
>  advisories/GLIBC-SA-2026-0012 |   4 +-
>  resolv/Makefile               |   2 +
>  resolv/ns_print.c             |  46 ++---
>  resolv/tst-ns_sprintrr.c      | 322 ++++++++++++++++++++++++++++++++++
>  4 files changed, 352 insertions(+), 22 deletions(-)
>  create mode 100644 resolv/tst-ns_sprintrr.c
>
>
> base-commit: dbc2b380fac027fed5db6ae864e4accf9f82a3fd

Ping.  I'd appreciate review of this security fix.

  <https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com>

Thanks,
Florian