Repository navigation
fix(cve): CVE-2026-5435 - resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435) - #48
Merged
Merged
Conversation
…rf (CVE-2026-5435) CVE: CVE-2026-5435 (high) - glibc 中弃用的函数 ns_printrrf、ns_printrr 和 fp_nquery 在执行 TSIG 记录打印时无法强制执行调用者提供的缓冲区长度，可能导致越界写入。TSIG 情况处理中的缺陷在 ns_sprintrrf 中执行使用 sprintf 的格式化写入而不检查剩余缓冲区长度，可能会在缓冲区末尾写入多达 6 个字节。 Upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=ca44a6609c29a683b03575fa035c6d17aa591e72 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
TAG Bot TAG: 2.38-6deepin30 |
CVE-2026-6238) CVE: CVE-2026-6238 (medium) - GNU C 库版本 2.0.1 到 2.43 中的已弃用函数 ns_printrrf、ns_printrr 和 fp_nquery 在处理 A6、CERT、LOC、TKEY 或 TSIG 记录时，未能验证 DNS 响应中的 RDATA 内容与 RDATA 长度的匹配，可能导致应用程序崩溃或读取未初始化内存。 Upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=a7b60d23bbb56eaef59f4962e4140062e552600a Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…expansion (BZ 34091, CVE-2026 CVE: CVE-2026-6791 (medium) - 当展开以波浪号 (~) 后跟用户名的路径时，内部 parse_tilde 函数提取用户名以确定用户的家目录。实现使用 strndupa 宏直接在栈上分配此用户名的内存。由于此分配的大小由用户提供的输入的长度确定，没有任何边界检查，传递过长的用户名会导致栈溢出。 Upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=dae425b554207f7c4599c7fac707ad4c08545674 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
Contributor
|
/integrate |
|
AutoIntegrationPr Bot |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-5435 (high) - glibc 中弃用的函数 ns_printrrf、ns_printrr 和 fp_nquery 在执行 TSIG 记录打印时无法强制执行调用者提供的缓冲区长度，可能导致越界写入。TSIG 情况处理中的缺陷在 ns_sprintrrf 中执行使用 sprintf 的格式化写入而不检查剩余缓冲区长度，可能会在缓冲区末尾写入多达 6 个字节。
Upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=ca44a6609c29a683b03575fa035c6d17aa591e72
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-6238 (medium) - GNU C 库版本 2.0.1 到 2.43 中的已弃用函数 ns_printrrf、ns_printrr 和 fp_nquery 在处理 A6、CERT、LOC、TKEY 或 TSIG 记录时，未能验证 DNS 响应中的 RDATA 内容与 RDATA 长度的匹配，可能导致应用程序崩溃或读取未初始化内存。
Upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=a7b60d23bbb56eaef59f4962e4140062e552600a
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-6791 (medium) - 当展开以波浪号 (~) 后跟用户名的路径时，内部 parse_tilde 函数提取用户名以确定用户的家目录。实现使用 strndupa 宏直接在栈上分配此用户名的内存。由于此分配的大小由用户提供的输入的长度确定，没有任何边界检查，传递过长的用户名会导致栈溢出。
Upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=dae425b554207f7c4599c7fac707ad4c08545674
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b