An update for glibc is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3617 Final 1.0 1.0 2026-09-05 Initial 2026-09-05 2026-09-05 openEuler SA Tool V1.0 2026-09-05 glibc security update An update for glibc is now available for openEuler-24.03-LTS-SP1 The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more. Security Fix(es): A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499) A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117) A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489) An update for glibc is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium glibc https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3617 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-19499 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-77117 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-80489 https://nvd.nist.gov/vuln/detail/CVE-2026-19499 https://nvd.nist.gov/vuln/detail/CVE-2026-77117 https://nvd.nist.gov/vuln/detail/CVE-2026-80489 openEuler-24.03-LTS-SP1 glibc-2.38-124.oe2403sp1.aarch64.rpm glibc-all-langpacks-2.38-124.oe2403sp1.aarch64.rpm glibc-common-2.38-124.oe2403sp1.aarch64.rpm glibc-debuginfo-2.38-124.oe2403sp1.aarch64.rpm glibc-debugsource-2.38-124.oe2403sp1.aarch64.rpm glibc-debugutils-2.38-124.oe2403sp1.aarch64.rpm glibc-devel-2.38-124.oe2403sp1.aarch64.rpm glibc-locale-archive-2.38-124.oe2403sp1.aarch64.rpm glibc-locale-source-2.38-124.oe2403sp1.aarch64.rpm glibc-nss-devel-2.38-124.oe2403sp1.aarch64.rpm libnsl-2.38-124.oe2403sp1.aarch64.rpm nscd-2.38-124.oe2403sp1.aarch64.rpm nss_modules-2.38-124.oe2403sp1.aarch64.rpm glibc-2.38-124.oe2403sp1.src.rpm glibc-2.38-124.oe2403sp1.x86_64.rpm glibc-all-langpacks-2.38-124.oe2403sp1.x86_64.rpm glibc-common-2.38-124.oe2403sp1.x86_64.rpm glibc-debuginfo-2.38-124.oe2403sp1.x86_64.rpm glibc-debugsource-2.38-124.oe2403sp1.x86_64.rpm glibc-debugutils-2.38-124.oe2403sp1.x86_64.rpm glibc-devel-2.38-124.oe2403sp1.x86_64.rpm glibc-locale-archive-2.38-124.oe2403sp1.x86_64.rpm glibc-locale-source-2.38-124.oe2403sp1.x86_64.rpm glibc-nss-devel-2.38-124.oe2403sp1.x86_64.rpm libnsl-2.38-124.oe2403sp1.x86_64.rpm nscd-2.38-124.oe2403sp1.x86_64.rpm nss_modules-2.38-124.oe2403sp1.x86_64.rpm glibc-help-2.38-124.oe2403sp1.noarch.rpm A flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts. 2026-09-05 CVE-2026-19499 openEuler-24.03-LTS-SP1 Medium 6.8 AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H glibc security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3617 A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text. 2026-09-05 CVE-2026-77117 openEuler-24.03-LTS-SP1 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H glibc security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3617 A flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space. 2026-09-05 CVE-2026-80489 openEuler-24.03-LTS-SP1 Medium 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H glibc security update 2026-09-05 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3617