{ "summary": { "snap": { "added": [], "removed": [], "diff": [] }, "deb": { "added": [], "removed": [], "diff": [ "libc-bin", "libc6" ] } }, "diff": { "deb": [ { "name": "libc-bin", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false }, { "name": "libc6", "from_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.8", "version": "2.39-0ubuntu8.8" }, "to_version": { "source_package_name": "glibc", "source_package_version": "2.39-0ubuntu8.9", "version": "2.39-0ubuntu8.9" }, "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "launchpad_bugs_fixed": [], "changes": [ { "cves": [ { "cve": "CVE-2026-19499", "url": "https://ubuntu.com/security/CVE-2026-19499", "cve_description": "Buffer overflow in strfmon right-justification padding", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-19542", "url": "https://ubuntu.com/security/CVE-2026-19542", "cve_description": "[Out-of-bounds stack array access in tdelete]", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-6368", "url": "https://ubuntu.com/security/CVE-2026-6368", "cve_description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-6791", "url": "https://ubuntu.com/security/CVE-2026-6791", "cve_description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "cve_priority": "medium", "cve_public_date": "2026-08-10 19:17:00 UTC" }, { "cve": "CVE-2026-77117", "url": "https://ubuntu.com/security/CVE-2026-77117", "cve_description": "SHIFT_JISX0213 converter hang in shift_jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-27" }, { "cve": "CVE-2026-80489", "url": "https://ubuntu.com/security/CVE-2026-80489", "cve_description": "EUC_JISX0213 converter hang in euc-jisx0213.c", "cve_priority": "medium", "cve_public_date": "2026-08-31" } ], "log": [ "", " * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding", " - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in", " strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,", " stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.", " - CVE-2026-19499", " * SECURITY UPDATE: Out-of-bounds stack array access in tdelete", " - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write", " in tdelete (bug 34506) in misc/tsearch.c.", " - CVE-2026-19542", " * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND", " - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to", " preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in", " posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.", " - CVE-2026-6368", " * SECURITY UPDATE: stack clash issue when expanding long tilde paths", " - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp", " tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-", " wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-", " wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-", " tilde.root/etc/passwd, posix/wordexp.c.", " - CVE-2026-6791", " * SECURITY UPDATE: SHIFT_JISX0213 converter hang", " - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding", " lacks pending character reset (CVE-2026-77117) in", " iconvdata/shift_jisx0213.c.", " - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,", " bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.", " - CVE-2026-77117", " * SECURITY UPDATE: EUC_JISX0213 converter hang", " - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding", " lacks pending character reset (CVE-2026-80489) in iconvdata/euc-", " jisx0213.c.", " - CVE-2026-80489", "" ], "package": "glibc", "version": "2.39-0ubuntu8.9", "urgency": "medium", "distributions": "noble-security", "launchpad_bugs_fixed": [], "author": "Marc Deslauriers ", "date": "Thu, 03 Sep 2026 10:15:12 -0400" } ], "notes": null, "is_version_downgrade": false } ], "snap": [] }, "added": { "deb": [], "snap": [] }, "removed": { "deb": [], "snap": [] }, "notes": "Changelog diff for Ubuntu 24.04 noble image from daily image serial 20260910 to 20260912", "from_series": "noble", "to_series": "noble", "from_serial": "20260910", "to_serial": "20260912", "from_manifest_filename": "daily_manifest.previous", "to_manifest_filename": "manifest.current" }