CVE-2026-4437: The GNU C Library glibc, грешка в паметта

Описание

Оригинално описание

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Засегнати продукти

• The GNU C Library glibc: 2.34 до 2.43
• Siemens: още 3 продукта, добавени от Siemens

  SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Вид слабост

• CWE-125 Четене извън границите на буфера

История

Други уязвимости в The GNU C Library glibc

• 5.9CVE-2026-122054
• 7.0CVE-2026-84243
• 6.1CVE-2026-63357
• 6.1CVE-2026-63356
• 6.1CVE-2026-63355

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-4437
• https://nvd.nist.gov/vuln/detail/CVE-2026-4437
• https://sourceware.org/bugzilla/show_bug.cgi?id=34014
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html