Logo
›
›component›glibc
Name
glibc
Version
2.43+git
Type
library
Description
GLIBC (GNU C Library)
Licenses
GPL-2.0-only & LGPL-2.1-or-later
PURL
-
CPE
cpe:2.3:*:gnu:glibc:2.43+git:*:*:*:*:*:*:*

Other Versions#

Project
Branch
Version
yocto
kirkstone
2.35
yocto
scarthgap
2.39+git

Patches#

#
Title
Author
Resolve
1
nativesdk-glibc: Fall back to faccessat on faccess2 returns
Khem Raj <raj.khem@gmail.com>
2
eglibc: Forward port cross locale generation support
Khem Raj <raj.khem@gmail.com>
3
eglibc: Cross building and testing instructions
Khem Raj <raj.khem@gmail.com>
4
tzselect.ksh: Use /bin/sh default shell interpreter
Khem Raj <raj.khem@gmail.com>
5
eglibc: Resolve __fpscr_values on SH4
Khem Raj <raj.khem@gmail.com>
6
localedef --add-to-archive uses a hard-coded locale path
Khem Raj <raj.khem@gmail.com>
7
eglibc: Help bootstrap cross toolchain
Khem Raj <raj.khem@gmail.com>
8
stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
Rocket Ma <marocketbd@gmail.com>
CVE-2026-5450
9
wordsize.h: Unify the header between arm and aarch64
Khem Raj <raj.khem@gmail.com>
10
nativesdk-glibc: Fix buffer overrun with a relocated SDK
Khem Raj <raj.khem@gmail.com>
11
nativesdk-glibc: Look for host system ld.so.cache as well
Khem Raj <raj.khem@gmail.com>
12
fix create thread failed in unprivileged process [BZ #28287]
Hongxu Jia <hongxu.jia@windriver.com>
13
tests: Skip 2 qemu tests that can hang in oe-selftest
Yash Shinde <Yash.Shinde@windriver.com>
14
Propagate -ffile-prefix-map from CFLAGS to ASFLAGS.
Khem Raj <raj.khem@gmail.com>
15
timezone: Make shell interpreter overridable in tzselect.ksh
Khem Raj <raj.khem@gmail.com>
16
Replace echo with printf builtin in nscd init script
Khem Raj <raj.khem@gmail.com>
17
localedef: Add hardlink resolver from util-linux
Jason Wessel <jason.wessel@windriver.com>
18
powerpc: Do not ask compiler for finding arch
Khem Raj <raj.khem@gmail.com>
19
localedef: fix-ups hardlink to make it compile
Jason Wessel <jason.wessel@windriver.com>
20
sysdeps/gnu/configure.ac: Set libc_cv_rootsbindir only if its
Khem Raj <raj.khem@gmail.com>
21
'yes' within the path sets wrong config variables
Khem Raj <raj.khem@gmail.com>
22
nativesdk-glibc: Raise the size of arrays containing dl paths
Khem Raj <raj.khem@gmail.com>
23
nativesdk-glibc: Make relocatable install for locales
Khem Raj <raj.khem@gmail.com>

Vulnerabilities#

Name
Analysis
Description
CVE-2026-6238
Exploitable
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory. These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.
CVE-2026-5450
Patched
Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.
CVE-2026-5435
Exploitable
The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.
CVE-2010-4756
Exploitable
The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.