From d98e3f11e91f091729740eac857677cebbb6edf7 Mon Sep 17 00:00:00 2001 From: Waldemar Brodkorb Date: Wed, 21 Jan 2026 10:16:21 +0100 Subject: [PATCH] package/{glibc, localedef}: security bump to version 2.42-51-gcbf39c26b Fixes following CVE's: - CVE-2025-15281 wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory https://www.cve.org/CVERecord?id=CVE-2025-15281 https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2026-0003 fixed by upstream commit: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=cbf39c26b25801e9bc88499b4fd361ac172d4125 - CVE-2026-0861 Integer overflow in memalign leads to heap corruption https://www.cve.org/CVERecord?id=CVE-2026-0861 https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2026-0001 fixed by upstream commit: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=b0ec8fb689df862171f0f78994a3bdeb51313545 - CVE-2026-0915 getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler https://www.cve.org/CVERecord?id=CVE-2026-0915 https://sourceware.org/cgit/glibc/tree/advisories/GLIBC-SA-2026-0002 fixed by upstream commit: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=453e6b8dbab935257eb0802b0c97bca6b67ba30e For a full list of changes, see: https://sourceware.org/git/?p=glibc.git;a=shortlog;h=cbf39c26b25801e9bc88499b4fd361ac172d4125 Signed-off-by: Waldemar Brodkorb [Julien: add extra info in commit log] Signed-off-by: Julien Olivain (cherry picked from commit 18de297a5ad3d1fc1b44f54ae69289ca10200ad5) Signed-off-by: Thomas Perale --- package/glibc/glibc.hash | 2 +- package/glibc/glibc.mk | 2 +- package/localedef/localedef.mk | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash index 538f8b69a7..a58bb7b9a7 100644 --- a/package/glibc/glibc.hash +++ b/package/glibc/glibc.hash @@ -1,5 +1,5 @@ # Locally calculated (fetched from Github) -sha256 a364a548ebda9c570f5bf62bf5e4ad3240a90056455b9edfbf1472a7254bd1c0 glibc-2.42-3-gbc13db73937730401d592b33092db6df806d193e.tar.gz +sha256 f63ffa06cd17ee8ff891f6de41de6e189b96edc6b2be2807ae597291f4464388 glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125.tar.gz # Hashes for license files sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 9c3ff7124e..e3453b8cc2 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -7,7 +7,7 @@ # Generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- # When updating the version, please also update localedef -GLIBC_VERSION = 2.42-3-gbc13db73937730401d592b33092db6df806d193e +GLIBC_VERSION = 2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125 # Upstream doesn't officially provide an https download link. # There is one (https://sourceware.org/git/glibc.git) but it's not reliable, diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk index c34fe22b5e..254a79026a 100644 --- a/package/localedef/localedef.mk +++ b/package/localedef/localedef.mk @@ -7,7 +7,7 @@ # Use the same VERSION and SITE as target glibc # As in glibc.mk, generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- -LOCALEDEF_VERSION = 2.42-3-gbc13db73937730401d592b33092db6df806d193e +LOCALEDEF_VERSION = 2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION).tar.gz LOCALEDEF_SITE = $(call github,bminor,glibc,$(LOCALEDEF_VERSION)) HOST_LOCALEDEF_DL_SUBDIR = glibc