glibc (2.35-0ubuntu3.14) jammy-security; urgency=medium

  * SECURITY UPDATE: assertion failure via IBM1390 or IBM1399 charsets
    - debian/patches/CVE-2026-4046.patch: Use pending character state in
      IBM1390, IBM1399 character sets in iconvdata/Makefile,
      iconvdata/ibm1364.c, iconvdata/tst-bug33980.c.
    - CVE-2026-4046
  * SECURITY UPDATE: out-of-bounds write in deprecated debugging function
    - debian/patches/CVE-2026-5435.patch: resolv: More types as unknown in
      ns_sprintrrf in resolv/ns_print.c.
    - CVE-2026-5435
  * SECURITY UPDATE: one byte heap buffer overflow in scanf %mc
    - debian/patches/CVE-2026-5450.patch: stdio-common: Fix buffer overflow in
      scanf %mc [BZ #34008] in stdio-common/Makefile, stdio-common/tst-vfscanf-
      bz34008.c, stdio-common/vfscanf-internal.c.
    - CVE-2026-5450
  * SECURITY UPDATE: crash or info disclosure in ungetwc function
    - debian/patches/CVE-2026-5928.patch: libio: Fix ungetwc operating on byte
      stream in libio/Makefile, libio/bug-wgenops-bz33998.c, libio/wgenops.c.
    - CVE-2026-5928
  * SECURITY UPDATE: crash in deprecated debugging functions
    - debian/patches/CVE-2026-6238-pre1.patch: resolv: Declare __p_class_syms,
      __p_type_syms for internal use in include/resolv.h, resolv/res_debug.c.
    - debian/patches/CVE-2026-6238-pre2.patch: resolv: Fix ns_sprintrrf
      formatting of class, type values in resolv/ns_print.c.
    - debian/patches/CVE-2026-6238-pre3.patch: resolv: Improve formatting of
      unknown records in ns_sprintrrf in resolv/ns_print.c.
    - debian/patches/CVE-2026-6238-pre4.patch: resolv: Check for inet_ntop
      failure in ns_sprintrrf in resolv/ns_print.c.
    - debian/patches/CVE-2026-6238-1.patch: resolv: Fix buffer overreads in
      ns_sprintrrf in resolv/ns_print.c.
    - debian/patches/CVE-2026-6238-2.patch: resolv: Add test case tst-
      ns_sprintrr in resolv/Makefile, resolv/tst-ns_sprintrr.c.
    - CVE-2026-6238

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 24 Jul 2026 08:11:17 -0400

glibc (2.35-0ubuntu3.13) jammy-security; urgency=medium

  * SECURITY UPDATE: use-after-free in wordexp_t fields
    - debian/patches/CVE-2025-15281.patch: posix: Reset wordexp_t fields
      with WRDE_REUSE
    - CVE-2025-15281
  * SECURITY UPDATE: integer overflow in memalign
    - debian/patches/CVE-2026-0861.patch: memalign: reinstate alignment
      overflow check
    - CVE-2026-0861
  * SECURITY UPDATE: memory leak in NSS DNS
    - debian/patches/CVE-2026-0915.patch: resolv: Fix NSS DNS backend for
      getnetbyaddr
    - CVE-2026-0915

 -- Nishit Majithia <nishit.majithia@canonical.com>  Fri, 30 Jan 2026 13:50:56 +0530

glibc (2.35-0ubuntu3.12) jammy; urgency=medium

  * d/p/lp2089789-*.patch: fix malloc performance regression (LP: #2089789)

 -- Simon Chopin <schopin@ubuntu.com>  Tue, 15 Jul 2025 11:40:00 +0200

glibc (2.35-0ubuntu3.11) jammy-security; urgency=medium

  * SECURITY UPDATE: double-free in regcomp function
    - debian/patches/any/CVE-2025-8058.patch: fix double-free after
      allocation failure in regcomp in posix/Makefile, posix/regcomp.c,
      posix/tst-regcomp-bracket-free.c.
    - CVE-2025-8058

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 17 Sep 2025 11:26:08 -0400

glibc (2.35-0ubuntu3.10) jammy-security; urgency=medium

  * SECURITY UPDATE: privelege escalation issue
    - debian/patches/any/CVE-2025-4802.patch: elf: Ignore LD_LIBRARY_PATH
      and debug env var for setuid for static
    - CVE-2025-4802

 -- Nishit Majithia <nishit.majithia@canonical.com>  Mon, 26 May 2025 12:55:00 +0530

glibc (2.35-0ubuntu3.9) jammy-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in the assert function.
    - debian/patches/any/CVE-2025-0395.patch: Change total to ALIGN_UP
      calculation and include libc-pointer-arith.h in assert/assert.c and
      sysdeps/posix/libc_fatal.c.
    - CVE-2025-0395

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 28 Jan 2025 16:55:30 -0330

glibc (2.35-0ubuntu3.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Stack-based buffer overflow
    - debian/patches/CVE-2024-33599.patch: CVE-2024-33599: nscd: Stack-
      based buffer overflow in netgroup cache.
    - CVE-2024-33599
  * SECURITY UPDATE: Null pointer
    - debian/patches/CVE-2024-33600_1.patch: CVE-2024-33600: nscd: Avoid
      null pointer crashes after notfound response.
    - debian/patches/CVE-2024-33600_2.patch: CVE-2024-33600: nscd: Do
      not send missing not-found response in addgetnetgrentX.
    - CVE-2024-33600
  * SECURITY UPDATE: Memory corruption
    - debian/patches/CVE-2024-33601_33602.patch: CVE-2024-33601, CVE-
      2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX.
    - CVE-2024-33601
    - CVE-2024-33602

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Mon, 06 May 2024 17:34:28 -0300

glibc (2.35-0ubuntu3.7) jammy-security; urgency=medium

  * SECURITY UPDATE: OOB write in iconv plugin ISO-2022-CN-EXT
    - debian/patches/any/CVE-2024-2961.patch: fix out-of-bound writes when
      writing escape sequence in iconvdata/Makefile,
      iconvdata/iso-2022-cn-ext.c, iconvdata/tst-iconv-iso-2022-cn-ext.c.
    - CVE-2024-2961

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 16 Apr 2024 09:40:36 -0400

glibc (2.35-0ubuntu3.6) jammy-security; urgency=medium

  * SECURITY REGRESSION: incorrect processing of address family with nscd
    (LP: #2047155)
    - debian/patches/lp2047155/lp2047155-refactor-bits-for-readability.patch:
      split out line processing for 'label', 'precedence' and 'scopev4' into
      separate functions (gaiconf_inet).
    - debian/patches/lp2047155/lp2047155-avoid-if-to-else-jump.patch: clean up
      another antipattern where code flows from an if condition to its else
      counterpart with a goto (gai_init).
    - debian/patches/lp2047155/lp2047155-refactor-code-for-readability.patch:
      refactor the code and make it easier to follow by removing the confusing
      close_retry goto jump (getaddrinfo).
    - debian/patches/lp2047155/
      lp2047155-get-nscd-addresses-fix-subscript-typos.patch: fix the
      subscript on air->family, which was accidentally set to 'count' when it
      should have remained as 'i' (get_nscd_addresses).
    - CVE-2023-4806

 -- Camila Camargo de Matos <camila.camargodematos@canonical.com>  Tue, 02 Jan 2024 10:22:42 -0300

glibc (2.35-0ubuntu3.5) jammy-security; urgency=medium

  * SECURITY UPDATE: use-after-free through getcanonname_r plugin call
    - debian/patches/any/CVE-2023-4806-pre1.patch: sort tests and
      tests-container and put one test per line (nss).
    - debian/patches/any/CVE-2023-4806-pre2.patch: simplify canon name
      resolution (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre3.patch: fix leak with AI_ALL
      (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre4.patch: simplify service resolution
      (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre5.patch: make numeric lookup a
      separate routine (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre6.patch: split simple gethostbyname
      into its own function (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre7.patch: split nscd lookup code into
      its own function (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre8.patch: separate nss lookup loop
      into its own function (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre9.patch: make gethosts into a
      function (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre10.patch: split loopback lookup into
      its own function (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre11.patch: split result generation
      into its own function (gaih_inet).
    - debian/patches/any/CVE-2023-4806-pre12.patch: return EAI_MEMORY on
      allocation failure (gethosts).
    - debian/patches/any/CVE-2023-4806.patch: copy h_name over and free it at
      the end (getaddrinfo).
    - CVE-2023-4806
  * SECURITY UPDATE: use-after-free in gaih_inet function
    - debian/patches/any/CVE-2023-4813.patch: simplify allocations and fix
      merge and continue actions.
    - CVE-2023-4813
  * SECURITY UPDATE: memory leak in getaddrinfo
    - debian/patches/any/CVE-2023-5156.patch: fix leak in getaddrinfo
      introduced by the fix for CVE-2023-4806.
    - CVE-2023-5156

 -- Camila Camargo de Matos <camila.camargodematos@canonical.com>  Wed, 22 Nov 2023 10:18:45 -0300

# For older changelog entries, run 'apt-get changelog libc6'
