UbuntuUpdates.org

Package "libc6-dbg"

Name: libc6-dbg

Description:

GNU C Library: detached debugging symbols
Latest version: 2.39-0ubuntu8.12
Release: noble (24.04)
Level: updates
Repository: main
Head package: glibc
Homepage: https://www.gnu.org/software/libc/libc.html

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libc6-dbg"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libc6-dbg" in Noble

Repository Area Version
base main 2.39-0ubuntu8
security main 2.39-0ubuntu8.12

Changelog

Version: 2.39-0ubuntu8.12 2026-11-12 23:07:49 UTC

glibc (2.39-0ubuntu8.12) noble-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow
    - debian/patches/CVE-2026-18374.patch: libio: Fix heap buffer overflow in
      ccs= handling in libio/fileops.c.
    - CVE-2026-18374
  * SECURITY UPDATE: DoS with long domain name
    - debian/patches/CVE-2026-8674.patch: resolv: Fix assertion failure on
      search list truncation in resolv/resolv_conf.c,
      resolv/tst-resolv-res_init-skeleton.c.
    - CVE-2026-8674
  * SECURITY UPDATE: TOCTOU in dynamic loader
    - debian/patches/CVE-2026-86805_95818-pre1.patch: support: Add
      support_next_to_fault_before support function in support/next_to_fault.c,
      support/next_to_fault.h.
    - debian/patches/CVE-2026-86805_95818-pre2.patch: support: Add envp
      argument to support_capture_subprogram in elf/tst-audit18.c,
      elf/tst-audit19b.c, elf/tst-audit22.c, elf/tst-audit23.c,
      elf/tst-audit25a.c, elf/tst-audit25b.c, elf/tst-glibc-hwcaps-2-cache.c,
      elf/tst-rtld-run-static.c, elf/tst-tunables.c,
      support/capture_subprocess.h, support/subprocess.h,
      support/support_capture_subprocess.c, support/support_subprocess.c,
      support/tst-support_capture_subprocess.c,
      sysdeps/x86/tst-hwcap-tunables.c.
    - debian/patches/CVE-2026-86805_95818.patch: elf: Open the normalized
      $ORIGIN rpath in AT_SECURE programs in elf/Makefile, elf/dl-load.c,
      elf/dl-path-normalize.h, elf/libtst-origin-secure-mod.c, elf/tst-
      dl-path-normalize.c, elf/tst-origin-secure-evilmod.c, elf/tst-origin-
      secure-victim.c, elf/tst-origin-secure.c, elf/tst-origin-secure.h.
    - CVE-2026-86805
    - CVE-2026-95818
  * SECURITY UPDATE: stack overflow in nscd
    - debian/patches/CVE-2026-89092.patch: nscd: replace alloca with malloc
      in aicache, hstcache in nscd/aicache.c, nscd/hstcache.c.
    - CVE-2026-89092
  * SECURITY UPDATE: crash in strncasecmp on power8
    - debian/patches/CVE-2026-97399.patch: powerpc: Fix one byte overread in
      strncasecmp in string/Makefile, string/test-strncasecmp-nonarray.c,
      sysdeps/powerpc/powerpc64/power8/strcasecmp.S.
    - CVE-2026-97399
  * SECURITY UPDATE: arbitrary gettext load location via LANGUAGE var
    - debian/patches/CVE-2026-84243.patch: intl: Restrict path traversal when
      using LANGUAGE env var in intl/Makefile, intl/dcigettext.c,
      intl/tst-gettext-path-traversal.c.
    - CVE-2026-84243
  * Fix s390x QEMU user-mode emulation issue (LP: #2170563)
    - debian/patches/s390x-alignment.patch: set max-page-size on s390x in
      resolv/Makefile.

 -- Marc Deslauriers Thu, 05 Nov 2026 12:18:26 -0500
Source diff to previous version
2170563 qemu-user: s390x libresolv.so loading fails on 64 KiB-page ppc64el hosts when a mapping fragment overlaps a file-backed page beyond EOF
CVE-2026-18374 Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or
CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of rough
CVE-2026-86805 A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a
CVE-2026-95818 A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash
CVE-2026-89092 The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a response for
CVE-2026-97399 The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, whi
CVE-2026-84243 The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are

Version: 2.39-0ubuntu8.9 2026-09-10 16:07:46 UTC

glibc (2.39-0ubuntu8.9) noble-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in strfmon right-justification padding
    - debian/patches/CVE-2026-19499.patch: stdlib: Fix right-justification in
      strfmon (bug 34510, CVE-2026-19499) in stdlib/Makefile,
      stdlib/strfmon_l.c, stdlib/tst-strfmon-bug34510.c.
    - CVE-2026-19499
  * SECURITY UPDATE: Out-of-bounds stack array access in tdelete
    - debian/patches/CVE-2026-19542.patch: misc: Fix out-of-bounds array write
      in tdelete (bug 34506) in misc/tsearch.c.
    - CVE-2026-19542
  * SECURITY UPDATE: invalid memory when calling wordexp with WRDE_APPEND
    - debian/patches/CVE-2026-6368.patch: posix: Fix wordexp WRDE_APPEND to
      preserve state on non-NOSPACE errors (BZ 34090, CVE-2026-6368) in
      posix/Makefile, posix/tst-wordexp-append.c, posix/wordexp.c.
    - CVE-2026-6368
  * SECURITY UPDATE: stack clash issue when expanding long tilde paths
    - debian/patches/CVE-2026-6791.patch: posix: Fix stack overflow in wordexp
      tilde expansion (BZ 34091, CVE-2026-6791) in posix/Makefile, posix/tst-
      wordexp-tilde.c, posix/tst-wordexp-tilde.root/etc/group, posix/tst-
      wordexp-tilde.root/etc/nsswitch.conf, posix/tst-wordexp-
      tilde.root/etc/passwd, posix/wordexp.c.
    - CVE-2026-6791
  * SECURITY UPDATE: SHIFT_JISX0213 converter hang
    - debian/patches/CVE-2026-77117-1.patch: iconvdata: SHIFT_JISX0213 decoding
      lacks pending character reset (CVE-2026-77117) in
      iconvdata/shift_jisx0213.c.
    - debian/patches/CVE-2026-77117-2.patch: iconvdata: Test case for bug 34556,
      bug 34568 in iconvdata/Makefile, iconvdata/tst-jisx0213-progress.c.
    - CVE-2026-77117
  * SECURITY UPDATE: EUC_JISX0213 converter hang
    - debian/patches/CVE-2026-80489.patch: iconvdata: EUC_JISX0213 decoding
      lacks pending character reset (CVE-2026-80489) in iconvdata/euc-
      jisx0213.c.
    - CVE-2026-80489

 -- Marc Deslauriers Thu, 03 Sep 2026 10:15:12 -0400
Source diff to previous version
CVE-2026-19542 Out-of-bounds stack array access in tdelete
CVE-2026-6368 Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv me
CVE-2026-6791 When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the use

Version: 2.39-0ubuntu8.8 2026-07-27 16:10:35 UTC
No changelog available yet.
Source diff to previous version

Version: 2.39-0ubuntu8.7 2026-02-03 11:07:58 UTC

  glibc (2.39-0ubuntu8.7) noble-security; urgency=medium

  * SECURITY UPDATE: use-after-free in wordexp_t fields
    - debian/patches/CVE-2025-15281.patch: posix: Reset wordexp_t fields
      with WRDE_REUSE
    - CVE-2025-15281
  * SECURITY UPDATE: integer overflow in memalign
    - debian/patches/CVE-2026-0861.patch: memalign: reinstate alignment
      overflow check
    - CVE-2026-0861
  * SECURITY UPDATE: memory leak in NSS DNS
    - debian/patches/CVE-2026-0915.patch: resolv: Fix NSS DNS backend for
      getnetbyaddr
    - CVE-2026-0915

 -- Nishit Majithia <email address hidden> Fri, 30 Jan 2026 13:57:54 +0530
Source diff to previous version
CVE-2025-15281 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return un
CVE-2026-0861 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42
CVE-2026-0915 Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-v

Version: 2.39-0ubuntu8.6 2025-09-22 22:07:59 UTC

  glibc (2.39-0ubuntu8.6) noble-security; urgency=medium

  * SECURITY UPDATE: double-free in regcomp function
    - debian/patches/any/CVE-2025-8058.patch: fix double-free after
      allocation failure in regcomp in posix/Makefile, posix/regcomp.c,
      posix/tst-regcomp-bracket-free.c.
    - CVE-2025-8058

 -- Marc Deslauriers <email address hidden> Wed, 17 Sep 2025 10:55:42 -0400
CVE-2025-8058 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accompl


About   -   Send Feedback to @ubuntu_updates