UbuntuUpdates.org

Package "libc6"

Name: libc6

Description:

GNU C Library: Shared libraries
Latest version: 2.35-0ubuntu3.14
Release: jammy (22.04)
Level: security
Repository: main
Head package: glibc
Homepage: https://www.gnu.org/software/libc/libc.html

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libc6"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libc6" in Jammy

Repository Area Version
base main 2.35-0ubuntu3
updates main 2.35-0ubuntu3.14

Changelog

Version: 2.35-0ubuntu3.14 2026-07-27 14:10:10 UTC
No changelog available yet.
Source diff to previous version

Version: 2.35-0ubuntu3.13 2026-02-03 09:08:03 UTC

  glibc (2.35-0ubuntu3.13) jammy-security; urgency=medium

  * SECURITY UPDATE: use-after-free in wordexp_t fields
    - debian/patches/CVE-2025-15281.patch: posix: Reset wordexp_t fields
      with WRDE_REUSE
    - CVE-2025-15281
  * SECURITY UPDATE: integer overflow in memalign
    - debian/patches/CVE-2026-0861.patch: memalign: reinstate alignment
      overflow check
    - CVE-2026-0861
  * SECURITY UPDATE: memory leak in NSS DNS
    - debian/patches/CVE-2026-0915.patch: resolv: Fix NSS DNS backend for
      getnetbyaddr
    - CVE-2026-0915

 -- Nishit Majithia <email address hidden> Fri, 30 Jan 2026 13:50:56 +0530
Source diff to previous version
CVE-2025-15281 Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return un
CVE-2026-0861 Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42
CVE-2026-0915 Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-v

Version: 2.35-0ubuntu3.11 2025-09-22 20:07:08 UTC

  glibc (2.35-0ubuntu3.11) jammy-security; urgency=medium

  * SECURITY UPDATE: double-free in regcomp function
    - debian/patches/any/CVE-2025-8058.patch: fix double-free after
      allocation failure in regcomp in posix/Makefile, posix/regcomp.c,
      posix/tst-regcomp-bracket-free.c.
    - CVE-2025-8058

 -- Marc Deslauriers <email address hidden> Wed, 17 Sep 2025 11:26:08 -0400
Source diff to previous version
CVE-2025-8058 The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accompl

Version: 2.35-0ubuntu3.10 2025-05-28 13:07:12 UTC

  glibc (2.35-0ubuntu3.10) jammy-security; urgency=medium

  * SECURITY UPDATE: privelege escalation issue
    - debian/patches/any/CVE-2025-4802.patch: elf: Ignore LD_LIBRARY_PATH
      and debug env var for setuid for static
    - CVE-2025-4802

 -- Nishit Majithia <email address hidden> Mon, 26 May 2025 12:55:00 +0530
Source diff to previous version
CVE-2025-4802 Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamica

Version: 2.35-0ubuntu3.9 2025-02-08 17:06:59 UTC

  glibc (2.35-0ubuntu3.9) jammy-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in the assert function.
    - debian/patches/any/CVE-2025-0395.patch: Change total to ALIGN_UP
      calculation and include libc-pointer-arith.h in assert/assert.c and
      sysdeps/posix/libc_fatal.c.
    - CVE-2025-0395

 -- Hlib Korzhynskyy <email address hidden> Tue, 28 Jan 2025 16:55:30 -0330
CVE-2025-0395 When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message stri


About   -   Send Feedback to @ubuntu_updates