Most recent entries from all

ALSA-2026:19061 — Moderate: glibc security update

Affected: AlmaLinux:10: glibc, AlmaLinux:10: glibc-all-langpacks, AlmaLinux:10: glibc-benchtests, AlmaLinux:10: glibc-common, AlmaLinux:10: glibc-devel, AlmaLinux:10: glibc-doc, AlmaLinux:10: glibc-gconv-extra, AlmaLinux:10: glibc-langpack-aa, AlmaLinux:10: glibc-langpack-af, AlmaLinux:10: glibc-langpack-agr and 211 more

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

* glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

BELL-CVE-2026-4437

Affected: Alpaquita:23: glibc, Alpaquita:25: glibc, Alpaquita:stream: glibc, BellSoft Hardened Containers:23: glibc, BellSoft Hardened Containers:25: glibc, BellSoft Hardened Containers:stream: glibc

BREW-glibc-CVE-2026-4437 — gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

Affected: Homebrew: glibc

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

certfr-2026-avi-0376 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0376

EUVD-2026-336367

fkie_cve-2026-4437

GHSA-m5wq-r4r4-4qrh

msrc_CVE-2026-4437 — gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

msrc_CVE-2026-4437

OESA-2026-1802 — glibc security update

Affected: openEuler:24.03-LTS: glibc

The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt, login, exit and more. Security Fix(es):

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.(CVE-2026-4438)

openSUSE-SU-2026:10662-1 — glibc-2.43-1.1 on GA media

glibc-2.43-1.1 on GA media

RHSA-2026:22634 — Red Hat Security Advisory: Insights proxy Container Image

glib: GLib: Buffer underflow in GVariant parser leads to heap corruption glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters glibc: glibc: Denial of Service via iconv() function with specific character sets glibc: glibc: Incorrect DNS response parsing via crafted DNS server response glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key vim: arbitrary command execution via modeline sandbox bypass krb5: MIT Kerberos 5: Denial of Service via NULL pointer dereference in NegoEx mechanism krb5: MIT Kerberos 5 (krb5): Denial of Service via integer underflow and out-of-bounds read

RLSA-2026:19061 — Moderate: glibc security update

Affected: Rocky Linux:10: glibc

Security Fix(es):

* glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

* glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SSA-082556 — SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Note: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.

SUSE-SU-2026:20999-1 — Security update for glibc

Security update for glibc

UBUNTU-CVE-2026-4437

Affected: Ubuntu:Pro:14.04:LTS: eglibc, Ubuntu:24.04:LTS: glibc, Ubuntu:25.10: glibc

VDE-2026-088 — METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4

The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25.

The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25

All other vulnerabilities are to be fixed in the upcoming releases.

WID-SEC-W-2026-0817 — GNU libc: Mehrere Schwachstellen ermöglichen Manipulation von DNS Antworten

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GNU libc ausnutzen, um DNS Antworten zu manipulieren.