Threats Tagged 'cve-2026-77117'

A security update addresses an out-of-bounds read and write vulnerability in the libpcap library, which is used for low-level network monitoring. This vulnerability (CVE-2026-0799) allows arbitrary memory access. The issue affects multiple Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products across various architectures. Red Hat has released an important security advisory with updated libpcap packages to fix this vulnerability.

This security update for glibc addresses multiple vulnerabilities including invalid free, stack overflow, buffer overflows, out-of-bounds writes, assertion failures, and a race condition that could allow local privilege escalation. The update fixes issues in components such as wordexp, resolv_conf, fopen ccs extension, strfmon, tdelete, and character decoding routines. The vulnerabilities affect local and network contexts and can lead to process crashes or privilege escalation. The update is provided by SUSE and Red Hat for various glibc packages across architectures.

Multiple security vulnerabilities identified by CWE-1341 and CWE-120 were fixed in the glibc-2.44-1.1 package for openSUSE Tumbleweed and related Red Hat packages. These updates address flaws in the GNU C Library (glibc) to improve security. No known exploits have been reported in the wild. The severity of these issues is assessed as medium. Updated packages are available from SUSE and Red Hat, including language packs and hardened images RPMs.

A buffer overflow vulnerability exists in GNU C Library (glibc) versions 2.38 to 2.44 when calling strfmon or strfmon_l with right-justified width padding. This can cause writes past the end of the caller-supplied output buffer. Exploitation requires specific application code paths and conditions. At the time of the advisory, no network-facing impact is known. Red Hat has issued a security update addressing this issue in their Hardened Images RPMs.

CVE-2026-18374 is a medium severity buffer overflow vulnerability in the GNU C Library (glibc) affecting version 2.45 and earlier. It occurs when an attacker-controlled mode string passed to the fopen function uses the ,ccs= syntax extension with an effectively empty string, potentially causing a heap buffer overflow. This usage pattern is uncommon in typical GNU/Linux applications, and applications should validate user-supplied ccs values before passing them to fopen.

A vulnerability in GNU C Library (eglibc) versions 2.3 to 2.44 causes an infinite loop when converting crafted SHIFT_JISX0213 input if the output buffer is too small. This flaw affects the SHIFT_JISX0213 character set, which is not commonly used. A patch is available to fix this issue.