Advisories ยป MGASA-2026-0581

Updated glibc package fixes security vulnerabilities

Publication date: 09 Nov 2026
Modification date: 09 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-18374 , CVE-2026-89092 , CVE-2026-8674 , CVE-2026-86805 , CVE-2026-95818 , CVE-2026-84243

Description

Passing an effectively empty string to the `,ccs=` syntax extension of
the mode argument in the `fopen` function in the GNU C Library version
2.45 or earlier may result in a heap buffer overflow when the mode
string input to the function is attacker controlled. This usage pattern
is not seen in applications in common GNU/Linux distributions and
applications that process user-supplied values for `ccs` should not pass
them through without validation. (CVE-2026-18374)
Stack overflow in nscd due to unbounded alloca use. (CVE-2026-89092)
Assertion failure in the DNS stub resolver with a long search domain.
(CVE-2026-8674)
AT_SECURE programs may load attacker-controlled code via $ORIGIN.
(CVE-2026-86805)
AT_SECURE program buffer overflow via $ORIGIN processing.
(CVE-2026-95818)
Directory traversal via the LANGUAGE environment variable.
(CVE-2026-84243)

References

SRPMS

10/core