Moderate Vulnerability in glibc Package: Information Disclosure and Denial of Service
Summary
ALSA-2026:42733: Moderate: glibc security update. Affects compat-libpthread-nonshared versions < 2.28-251.el8_10.40. Fixed in 2.28-251.el8_10.40. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The glibc (GNU C Library) package is a core component of the Linux operating system, providing essential functionalities such as standard C libraries, POSIX thread libraries, and standard math libraries. It is crucial for the proper operation of various applications and services on the system. The glibc package is widely used across different Linux distributions, making its security paramount.
Vulnerability Detail
The vulnerability in the glibc package arises from the ungetwc function, which can lead to information disclosure or denial of service when specific wide character encodings are used. Additionally, there is an out-of-bounds write vulnerability during TSIG record processing and an application crash or uninitialized memory read that can occur via crafted DNS responses. These vulnerabilities can potentially allow attackers to exploit the system, leading to unauthorized access or service interruptions.
How To Fix
Minimum fixed version
2.28-251.el8_10.40
This is the first release that contains the fix.
sudo dnf update compat-libpthread-nonsharedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the affected functions in their applications or restrict access to the services that utilize glibc until the package is updated. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The glibc package has a moderate vulnerability that can lead to serious security issues if not addressed. Updating to the latest patched version is crucial to maintaining system security. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for compat-libpthread-nonshared →
FAQ
glibc, or GNU C Library, is a standard library for the C programming language, providing essential functionalities for Linux applications.
The risks include potential information disclosure, denial of service, application crashes, and unauthorized access to system resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider implementing temporary workarounds such as restricting access to affected services.
It is advisable to regularly monitor your software dependencies for vulnerabilities, ideally with automated tools like Vulert.
Related vulnerabilities
Recent vulnerabilities recorded for compat-libpthread-nonshared.
