[glibc] Document CVE-2026-6238
Siddhesh Poyarekar via Glibc-cvs <[email protected]>
| Newsgroups | gmane.comp.lib.glibc.cvs |
|---|---|
| Message-ID | <[email protected]> |
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=db5b939311710bd6cb9506cd7f61de054d3bdcee commit db5b939311710bd6cb9506cd7f61de054d3bdcee Author: Siddhesh Poyarekar <[email protected]> Date: Mon Apr 27 18:29:26 2026 -0400 Document CVE-2026-6238 Signed-off-by: Siddhesh Poyarekar <[email protected]> Diff: --- advisories/GLIBC-SA-2026-0012 | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012 new file mode 100644 index 0000000000..29498d905e --- /dev/null +++ b/advisories/GLIBC-SA-2026-0012 @@ -0,0 +1,18 @@ +Buffer overread in ns_printrrf with corrupted RDATA field + +The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the +GNU C Library version 2.2 and newer fail to validate the RDATA content +against the RDATA length in a DNS response when processing LOC, CERT, +TKEY or TSIG records, which may allow an attacker to craft a DNS +response, causing a target application to crash or read uninitialized +memory. + +These functions are for debugging only and hence not in the default path +of code executed by the DNS resolver. Further, they have been +deprecated since version 2.34 and should not be used by any new +applications. Applications should consider porting away from these +interfaces since they may be removed in future versions. + +CVE-Id: CVE-2026-6238 +Public-Date: 2026-04-11 +Vulnerable-Commit: b43b13ac2544b11f35be301d1589b51a8473e32b (2.1.1-735)