{ "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.2/schema/csaf.json", "document": { "category": "csaf_security_advisory", "csaf_version": "2.2", "distribution": { "tlp": { "label": "AMBER" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Generated from an analysis of SBOM cyclonedx.json (cyclonedx-json, sha256 0b7256c1504e598e3be00fc48ebba0a19e2f94d73b9357ca7193838bdda21c5c)." }, { "category": "general", "text": "This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: shieldbom (fail).", "title": "Analysis coverage" } ], "publisher": { "category": "vendor", "contact_details": "security@ndaal.eu", "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG", "namespace": "https://ndaal.eu/csaf" }, "references": [ { "category": "self", "summary": "This advisory", "url": "https://ndaal.eu/csaf/ndaal-sba-1239-0183" } ], "title": "Vulnerabilities found in SBOM cyclonedx.json", "tracking": { "current_release_date": "2026-09-01T17:01:35Z", "generator": { "engine": { "name": "ndaal SBOM Auditor", "version": "1.4.18" } }, "id": "ndaal-sba-1239-0183", "initial_release_date": "2026-09-01T17:01:35Z", "revision_history": [ { "date": "2026-09-01T17:01:35Z", "number": "1.0.0", "summary": "Initial advisory generated from an SBOM analysis." } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "full_product_names": [ { "name": "glibc@2.34-100.0.1.el9_4.3", "product_id": "CSAFPID-0001", "product_identification_helper": { "purls": [ "pkg:rpm/ol/glibc@2.34-100.0.1.el9_4.3?arch=x86_64&upstream=glibc-2.34-100.0.1.el9_4.3.src.rpm&distro=ol-9.4" ] } } ] }, "vulnerabilities": [ { "cve": "CVE-2025-15281", "notes": [ { "category": "description", "text": "[2.34-231.0.1.10]\n- Forward-port Oracle patches for ol9-u7\n Reviewed-by: [TBD]\n Oracle history:\n November-14-2025 Cupertino Miranda - 2.34-231.0.1.2\n - Forward-port Oracle patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n September-24-2025 Cupertino Miranda - 2.34-231.0.1\n - Forward-port Oracle patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n September-8-2025 Jose E. Marchesi - 2.34-228.0.1\n - Forward-port Oracle patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n August-5-2025 Cupertino Miranda - 2.34-217.0.1\n - Forward-port Oralce patches for ol9-u7\n Reviewed-by: Jose E. Marchesi \n August-5-2025 Cupertino Miranda - 2.34-168.0.1.23\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: Jose E. Marchesi \n June-30-2025 Cupertino Miranda - 2.34-168.0.1.20\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: Jose E. Marchesi \n June-9-2025 Cupertino Miranda - 2.34-168.0.1.19\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: David Faust \n May-17-2025 Cupertino Miranda - 2.34-168.0.1.14\n - Forward-port Oracle patches for ol9-u6\n Reviewed-by: Jose E. Marchesi \n March-6-2025 Cupertino Miranda - 2.34-168.0.1\n - Forward-port Oracle patches for ol9-u6\n Reviewed by: Jose E. Marchesi \n February-18-2025 Cupertino Miranda - 2.34-160.0.1\n - Forward-port Oracle patches for ol9-u6 DP\n Reviewed by: Jose E. Marchesi \n November-12-2024 Cupertino Miranda - 2.34-125.0.1.1\n - Forward-port Oracle patches for ol9-u5\n Reviewed by: Jose E. Marchesi \n October-1-2024 Cupertino Miranda - 2.34-100.0.1.4\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: David Faust \n August-26-2024 Jose E. Marchesi - 2.34-100.0.1.3\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: David Faust \n May-24-2024 Cupertino Miranda - 2.34-100.0.1.2\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: Jose E. Marchesi \n April-30-2024 Cupertino Miranda - 2.34-100.0.1\n - Forward-port Oracle patches for ol9-u4\n Reviewed by: Indu Bhagat \n March-28-2024 Cupertino Miranda - 2.34-100.0.1\n - Forward-port Oracle patches for ol9-u4-beta\n Reviewed by: Jose E. Marchesi \n March 15 2024 Cupertino Miranda - 2.34-83.0.2.12\n - Forward-port Oracle patches for ol9\n Reviewed by: Jose E. Marchesi \n February-26-2024 Cupertino Miranda - 2.34-83.0.2.7\n - OraBug 36322437 getaddrinfo does not return correct ipv6 address and family\n Reviewed by: Jose E. Marchesi \n October-24-2023 Cupertino Miranda - 2.34-83.0.1.7\n - Forward-port Oracle patches for ol9\n Reviewed by: Jose E. Marchesi \n October-4-2023 Cupertino Miranda - 2.34-82.0.1\n - Forward-port Oracle patches for ol9\n Reviewed by: Jose E. Marchesi \n April-18-2023 Cupertino Miranda - 2.34-60.0.2\n - OraBug 35305078 Glibc tunable to disable huge pages on pthread_create stacks\n - Created tunable glibc.pthread.stack_hugetlb to control when hugepages\n can be used for stack allocation.\n - In case THP are enabled and glibc.pthread.stack_hugetlb is set to\n 0, glibc will madvise the kernel not to use allow hugepages for stack\n allocations.\n Reviewed by: Jose E. Marchesi \n March-28-2023 Cupertino Miranda - 2.34-60.0.1\n - Merge Oracle patches for ol9-u2 beta\n Reviewed by: Jose E. Marchesi \n September-28-2022 Patrick McGehearty - 2.34-40.0.1\n - Merge Oracle patches for ol9-u1 beta\n Reviewed by: Jose E. Marchesi \n April-25-2022 Patrick McGehearty - 2.34-28.0.1\n - Merge Oracle patches with ol9 beta\n - Reviewed-by: Jose E. Marchesi \n\n[2.34-231.10]\n- Handle FUSE_GETXATTR during FUSE FS mount in tests (RHEL-145151)\n\n[2.34-231.9]\n- CVE-2025-15281: wordexp WRDE_REUSE uninitialized memory read (RHEL-144079)\n\n[2.34-231.8]\n- Ignore LD_PROFILE in SUID binaries (RHEL-142195)\n\n[2.34-231.7]\n- Remove default /var/tmp for LD_PROFILE_OUTPUT (RHEL-142195)\n\n[2.34-231.6]\n- CVE-2026-0915: Stack memory disclosure in getnetbyaddr (RHEL-141851)\n\n[2.34-231.5]\n- patch-git: Avoid trailing tabs in changelog (RHEL-141921)\n\n[2.34-231.4]\n- CVE-2026-0861: Check for alignment overflow in memalign functions\n (RHEL-141738)\n\n[2.34-231.3]\n- patch-git: Add auto-generated/ prefix to Source: files (RHEL-126050)\n\n[2.34-231.2]\n- patch-git: Import from rhel-9-main and turn on (RHEL-117087)" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "title": "ELSA-2026-2786", "remediations": [ { "category": "vendor_fix", "details": "Upgrade to 0:2.34-231.0.1.el9_7.10 or later.", "product_ids": [ "CSAFPID-0001" ] } ] } ] }