Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1289330

Bug#1133372: musl: CVE-2026-6042 CVE-2026-40200

Show all headers | View raw

Source: musl
Version: 1.2.5-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for musl.

CVE-2026-6042[0]:
| A security flaw has been discovered in musl libc up to 1.2.6.
| Affected is the function iconv of the file src/locale/iconv.c of the
| component GB18030 4-byte Decoder. Performing a manipulation results
| in inefficient algorithmic complexity. The attack must be initiated
| from a local position. To fix this issue, it is recommended to
| deploy a patch.


CVE-2026-40200[1]:
| An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-
| based memory corruption can occur during qsort of very large arrays,
| due to incorrectly implemented double-word primitives. The number of
| elements must exceed about seven million, i.e., the 32nd Leonardo
| number on 32-bit platforms (or the 64th Leonardo number on 64-bit
| platforms, which is not practical).


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-6042
    https://www.cve.org/CVERecord?id=CVE-2026-6042
    https://git.musl-libc.org/cgit/musl/commit/?id=67219f0130ec7c876ac0b299046460fad31caabf
[1] https://security-tracker.debian.org/tracker/CVE-2026-40200
    https://www.cve.org/CVERecord?id=CVE-2026-40200
    https://git.musl-libc.org/cgit/musl/commit/?id=228da39e38c1cae13cbe637e771412c1984dba5d

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next | Find similar

Thread

Bug#1133372: musl: CVE-2026-6042 CVE-2026-40200 Salvatore Bonaccorso <carnil@debian.org> - 2026-04-12 17:00 +0200

csiph-web