-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-205d532069 2026-01-27 04:51:32.146789+00:00 --------------------------------------------------------------------------------
Name : glibc Product : Fedora 43 Version : 2.42 Release : 9.fc43 URL : http://www.gnu.org/software/glibc/ Summary : The GNU libc libraries Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function. -------------------------------------------------------------------------------- Update Information: This update switches the currency symbol for Bulgaria to the Euro. Furthermore, it addresses several security vulnerabilities: A crash when wordexp is used with WRDE_REUSE (CVE-2025-15281) Information leakage from the stack if getnetbyaddr is called for the zero address (CVE-2026-0915) An integer overflow in memalign and related functions if they are called with out-of-bounds size/alignment combinations (CVE-2026-0861) LD_PROFILE is now ignored with a warning if LD_PROFILE_OUTPUT is not specified, rather than using the insecure /var/tmp default. -------------------------------------------------------------------------------- ChangeLog: * Fri Jan 23 2026 Florian Weimer <[email protected]> - 2.42-9 - Ignore LD_PROFILE if LD_PROFILE_OUTPUT is not set (#2432405) * Fri Jan 23 2026 Florian Weimer <[email protected]> - 2.42-8 - Auto-sync with upstream branch release/2.42/master, commit cbf39c26b25801e9bc88499b4fd361ac172d4125: - posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281) - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915) - memalign: reinstate alignment overflow check (CVE-2026-0861) * Tue Jan 13 2026 Florian Weimer <[email protected]> - 2.42-7 - Switch currency symbol for the bg_BG locale to euro (#2429016) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2429016 - glibc: Bulgaria joined the eurozone https://bugzilla.redhat.com/show_bug.cgi?id=2429016 [ 2 ] Bug #2430078 - CVE-2026-0861 glibc: Integer overflow in memalign leads to heap corruption [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2430078 [ 3 ] Bug #2430321 - CVE-2026-0915 glibc: glibc: Information disclosure via zero-valued network query [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2430321 [ 4 ] Bug #2431281 - CVE-2025-15281 glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2431281 [ 5 ] Bug #2432405 - glibc: Ignore LD_PROFILE if LD_PROFILE_OUTPUT is not set https://bugzilla.redhat.com/show_bug.cgi?id=2432405 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-205d532069' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
