mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/{glibc, localedef}: security bump to version 2.42-51-gcbf39c26b

Browse Source 
Fixes following CVE's:

- CVE-2025-15281
  wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
  https://www.cve.org/CVERecord?id=CVE-2025-15281
  https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2026-0003
  fixed by upstream commit:
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=cbf39c26b25801e9bc88499b4fd361ac172d4125

- CVE-2026-0861
  Integer overflow in memalign leads to heap corruption
  https://www.cve.org/CVERecord?id=CVE-2026-0861
  https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2026-0001
  fixed by upstream commit:
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=b0ec8fb689df862171f0f78994a3bdeb51313545

- CVE-2026-0915
  getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler
  https://www.cve.org/CVERecord?id=CVE-2026-0915
  https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2026-0002
  fixed by upstream commit:
  https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=453e6b8dbab935257eb0802b0c97bca6b67ba30e

For a full list of changes, see:
https://sourceware.org/git/?p=glibc.git;a=shortlog;h=cbf39c26b25801e9bc88499b4fd361ac172d4125

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 18de297a5a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Waldemar Brodkorb
2026-01-21 10:16:21 +01:00
committed by Thomas Perale
parent 52ff864c58
commit d98e3f11e9
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/glibc/glibc.hash
View File

@@ -1,5 +1,5 @@
# Locally calculated (fetched from Github)
sha256 a364a548ebda9c570f5bf62bf5e4ad3240a90056455b9edfbf1472a7254bd1c0 glibc-2.42-3-gbc13db73937730401d592b33092db6df806d193e.tar.gz
sha256 f63ffa06cd17ee8ff891f6de41de6e189b96edc6b2be2807ae597291f4464388 glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125.tar.gz
# Hashes for license files
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING

2
package/glibc/glibc.mk
View File

@@ -7,7 +7,7 @@
# Generate version string using:
# git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
# When updating the version, please also update localedef
GLIBC_VERSION = 2.42-3-gbc13db73937730401d592b33092db6df806d193e
GLIBC_VERSION = 2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
# Upstream doesn't officially provide an https download link.
# There is one (https://sourceware.org/git/glibc.git) but it's not reliable,

2
package/localedef/localedef.mk
View File

@@ -7,7 +7,7 @@
# Use the same VERSION and SITE as target glibc
# As in glibc.mk, generate version string using:
# git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
LOCALEDEF_VERSION = 2.42-3-gbc13db73937730401d592b33092db6df806d193e
LOCALEDEF_VERSION = 2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz
LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION))
HOST_LOCALEDEF_DL_SUBDIR = glibc