{"schema_version":"1.7.2","id":"OESA-2026-3617","modified":"2026-09-05T15:03:12Z","published":"2026-09-05T15:03:12Z","upstream":["CVE-2026-19499","CVE-2026-77117","CVE-2026-80489"],"summary":"glibc security update","details":"The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,  login, exit and more.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in glibc. The strfmon and strfmon_l functions are vulnerable to a buffer overflow when processing right-justified width padding. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts.(CVE-2026-19499)\n\nA flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.(CVE-2026-77117)\n\nA flaw was found in glibc. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted text to an application that converts text from SHIFT_JISX0213 to UCS-4. The crafted input can lead to a continuous loop of processing, preventing the application from making progress and consuming resources. Exploitation requires specific conditions, including the application retrying conversion after an error with limited output space.(CVE-2026-80489)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"glibc","purl":"pkg:rpm/openEuler/glibc&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-124.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["glibc-2.38-124.oe2403sp1.aarch64.rpm","glibc-all-langpacks-2.38-124.oe2403sp1.aarch64.rpm","glibc-common-2.38-124.oe2403sp1.aarch64.rpm","glibc-debuginfo-2.38-124.oe2403sp1.aarch64.rpm","glibc-debugsource-2.38-124.oe2403sp1.aarch64.rpm","glibc-debugutils-2.38-124.oe2403sp1.aarch64.rpm","glibc-devel-2.38-124.oe2403sp1.aarch64.rpm","glibc-locale-archive-2.38-124.oe2403sp1.aarch64.rpm","glibc-locale-source-2.38-124.oe2403sp1.aarch64.rpm","glibc-nss-devel-2.38-124.oe2403sp1.aarch64.rpm","libnsl-2.38-124.oe2403sp1.aarch64.rpm","nscd-2.38-124.oe2403sp1.aarch64.rpm","nss_modules-2.38-124.oe2403sp1.aarch64.rpm"],"noarch":["glibc-help-2.38-124.oe2403sp1.noarch.rpm"],"src":["glibc-2.38-124.oe2403sp1.src.rpm"],"x86_64":["glibc-2.38-124.oe2403sp1.x86_64.rpm","glibc-all-langpacks-2.38-124.oe2403sp1.x86_64.rpm","glibc-common-2.38-124.oe2403sp1.x86_64.rpm","glibc-debuginfo-2.38-124.oe2403sp1.x86_64.rpm","glibc-debugsource-2.38-124.oe2403sp1.x86_64.rpm","glibc-debugutils-2.38-124.oe2403sp1.x86_64.rpm","glibc-devel-2.38-124.oe2403sp1.x86_64.rpm","glibc-locale-archive-2.38-124.oe2403sp1.x86_64.rpm","glibc-locale-source-2.38-124.oe2403sp1.x86_64.rpm","glibc-nss-devel-2.38-124.oe2403sp1.x86_64.rpm","libnsl-2.38-124.oe2403sp1.x86_64.rpm","nscd-2.38-124.oe2403sp1.x86_64.rpm","nss_modules-2.38-124.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3617"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H"}],"database_specific":{"severity":"Medium"}}