Bug#1134543: marked as done (glibc: CVE-2026-5450)

This is a multi-part message in MIME format...

------------=_1781815502-1139398-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Thu, 18 Jun 2026 20:42:54 +0000
with message-id <[email protected]>
and subject line Bug#1134543: fixed in glibc 2.42-17
has caused the Debian Bug report #1134543,
regarding glibc: CVE-2026-5450
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
1134543: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1134543
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1781815502-1139398-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 21 Apr 2026 15:49:48 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00,FOURLA,FROMDEVELOPER,
	NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 16; hammy, 147; neutral, 34; spammy,
	1. spammytokens:0.942-+--H*r:bugs.debian.org
	hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc,
	0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug
Return-path: <[email protected]>
Received: via submission
	by buxtehude.debian.org with esmtp (Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wFDMA-007clU-2D
	for [email protected];
	Tue, 21 Apr 2026 15:49:48 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: glibc: CVE-2026-5450
Message-ID: <[email protected]>
X-Mailer: reportbug 13.2.0
Date: Tue, 21 Apr 2026 17:49:45 +0200
Delivered-To: [email protected]

Source: glibc
Version: 2.42-15
Severity: important
Tags: security upstream
Forwarded: https://sourceware.org/bugzilla/show_bug.cgi?id=34008
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerability was published for glibc.

CVE-2026-5450[0]:
| Calling the scanf family of functions with a %mc (malloc'd character
| match) in the GNU C Library version 2.7 to version 2.43 with a
| format width specifier with an explicit width greater than 1024
| could result in a one byte heap buffer overflow.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-5450
    https://www.cve.org/CVERecord?id=CVE-2026-5450
[1] https://sourceware.org/bugzilla/show_bug.cgi?id=34008
[2] https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0009

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

------------=_1781815502-1139398-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 1134543-close) by bugs.debian.org; 18 Jun 2026 20:42:57 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-113.1 required=4.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,
	MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED,SPF_HELO_PASS,SPF_PASS,
	USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 8; hammy, 150; neutral, 316; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload,
	0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo.
Return-path: <[email protected]>
Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:46794)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1waJZh-004ltM-31
	for [email protected];
	Thu, 18 Jun 2026 20:42:57 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1waJZg-003elF-06
	for [email protected];
	Thu, 18 Jun 2026 20:42:56 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=TmAAJhCnNqhs9+k+iany2Nr9FbVByc7KPrCZlfWBFio=; b=hskR/QmEwTiuDm7fSY2PjFrtK5
	Tl+D8aQM5BKf0TP5fds7STmhW+JXnglg/QlfWsmgoys6IlZSUTGjM+LRkMILnO4WrvNO2tRrPwtjV
	fSSho9XVqQV6UzihzJiwTLuof8vZRXxrMb09U0Z5c6hEwi2k5kgss0ZbHi+OZ2GVjIsJea6PZsUf7
	OwVz44HZsQbUDsgkntzD2lnxLt2DelXmLrBD3BGN48s/hIt9zG+hbW8e5r80IGheBR3b5jkD94kjy
	CR6UZ2A0g8ydpQuq/QL9jcEngTR3P4V578ud2EDsZ1poY8bEmQ8vRZPOBBGvLCcaGrWMiyyu2c25c
	ZuO1l4Ig==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1waJZe-00000009zHd-3QpV;
	Thu, 18 Jun 2026 20:42:54 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: Aurelien Jarno <[email protected]>
To: [email protected]
X-DAK: dak process-upload
X-Debian: DAK
X-Debian-Package: glibc
Debian: DAK
Debian-Changes: glibc_2.42-17_source.changes
Debian-Source: glibc
Debian-Version: 2.42-17
Debian-Architecture: source
Debian-Suite: unstable
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#1134543: fixed in glibc 2.42-17
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============4253597873002987762=="
Message-Id: <[email protected]>
Date: Thu, 18 Jun 2026 20:42:54 +0000
X-CrossAssassin-Score: 2

--===============4253597873002987762==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: glibc
Source-Version: 2.42-17
Done: Aurelien Jarno <[email protected]>

We believe that the bug you reported is fixed in the latest version of
glibc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <[email protected]> (supplier of updated glibc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 18 Jun 2026 21:48:16 +0200
Source: glibc
Architecture: source
Version: 2.42-17
Distribution: unstable
Urgency: medium
Maintainer: GNU Libc Maintainers <[email protected]>
Changed-By: Aurelien Jarno <[email protected]>
Closes: 1133139 1134543 1134544
Changes:
 glibc (2.42-17) unstable; urgency=3Dmedium
 .
   [ Aurelien Jarno ]
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Fix buffer overflow in scanf %mc (CVE-2026-5450).  Closes: #1134543.
     - Fix ungetwc operating on byte stream (CVE-2026-5928).  Closes: #113454=
4.
     - Save/restore VFP registers inPLT trampolines on arm.  Closes: #1133139.
     - Suppress iconv intermediate errors with //TRANSLIT.
     - debian/patches/hurd-i386/git-run-iconv-test.sh.diff: rebased.
   * debian/rules.d/build.mk: append extra_cflags to CFLAGS and ASFLAGS.
   * debian/control.in/libc: stop suggesting libnss-nisplus.
   * debian/debhelper.in/libc-bin.lintian-overrides: add a
     statically-linked-binary override for the ldconfig binary.
   * debian/control.in/main: build-depends on libselinux-dev instead of
     libselinux1-dev.
 .
   [ Miao Wang ]
   * debian/libc6.symbols.loong64: add.
 .
   [ Samuel Thibault ]
   * debian/patches/hurd-i386/git-SO_TIMESTAMP.diff: Add SO_TIMESTAMP macro.
Checksums-Sha1:
 853c76d4926af85e1eb47cfadf665e3d6cd3cbaf 8575 glibc_2.42-17.dsc
 ae0e7f2dd7f1ef10f9847c9e93532044a5e95acf 447488 glibc_2.42-17.debian.tar.xz
 b32f8e34e86d37e31f82938ecae9eb114e70b05e 9474 glibc_2.42-17_source.buildinfo
Checksums-Sha256:
 d004ab83368dec1f86aec110d13d1eaf21b261416e5f7c74f18c8b9ce2d02b79 8575 glibc_=
2.42-17.dsc
 89b79a67661b89a4160ef1b2f01a1eb7b428c686f18de463581b408ba9765e62 447488 glib=
c_2.42-17.debian.tar.xz
 d1720e1efee2058a8c307845a71a549cc5c4281b3df55b6c23e17726ea9777eb 9474 glibc_=
2.42-17_source.buildinfo
Files:
 59ba9441424493ab42de86e0cb47af8d 8575 libs required glibc_2.42-17.dsc
 fc88b43e4437d8388a5e79558d3243b8 447488 libs required glibc_2.42-17.debian.t=
ar.xz
 7b6a7870542517c4b89f316ac9ce5619 9474 libs required glibc_2.42-17_source.bui=
ldinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUryGlb40+QrX1Ay4E4jA+JnoM2sFAmo0TCQACgkQE4jA+Jno
M2vCUw/+OKPA4+V6kCy4U86/X/rBzhA7G+ZRvYSaoBDfP8B8h+UDSXq3N4MmVKPx
hWAVtpzOiFo/aKmiy6DGKKdM6Wb50TZ0vvx+07c4sNAVpQh5ZR+MrbPvP82jNG2o
t7qP4VqVEToMSflhRYwBR+pMOazy5C+Mw71r7aAkDOiqhos4lgFutvNGOX3bVuts
UPuWND2S/KCMn9qgUp3bnlfYK/OXArQzH4MBYjGB3uHOXGg+xLKWPZQO39ufAGKA
m3GbgfCneO/dVp0qzCQeCdjZ5e3gvqR/GfKPRq59/9Zr58nq3bji1zyKfiMb7UxG
I7chnsOeL2k1SN8+b/mg0RpCWbeMGXdSRfIL39KBxypvGt+rRxlWpqcNYBlZuVaI
nhqBPjOSbz5Ox7QjZdVhpaojt9yxWk+Is+0hZrl1mkxIC4qang821KuW3d8UGjua
vTkGhKZGjYqcSsSpQs+iuOxaX4I/QsDnTNHv8MT9zG3HaYazSO8Fqh/lorjJySms
hUhIbpIBWkhqYgZcZKVNWQKjGaUwHZpCjdfYsON5OLMV/MvXAfFkokZMQFpr9A0x
9E/MqFPvckZWAGvaXSwAylDLyUCdMF6mHfHCHJd8m3c4Y66uJKSA27YbSwIsRwAH
7ZEm07fOR1eUF7CcocGvapnRsXCLpErc9tUOs2itNUsiBcQKHKo=3D
=3Dkmrf
-----END PGP SIGNATURE-----


--===============4253597873002987762==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCajRYTgAKCRCb9qggYcy5
IWBvAQCVKHSPNw94zBOCaiuERdO8XeO3Uq0Gyr6vSlb1j4SYBwEAizuOkJMhgowv
DotqBXNTu9YqOevqy/Bf2QdDaejokQs=
=Ur1v
-----END PGP SIGNATURE-----

--===============4253597873002987762==--
------------=_1781815502-1139398-0--