← All notices | Source (USN-8737-1) | Text version

QSN-8737-1: GNU C Library vulnerabilities

September 8, 2026

Summary

Several security issues were fixed in GNU C Library.

Details

It was discovered that GNU C Library had a buffer overflow in the strfmon function when handling right-justification padding. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-19499)

It was discovered that GNU C Library had an out-of-bounds stack array access in the tdelete function. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-19542)

It was discovered that GNU C Library incorrectly handled memory when calling wordexp with the WRDE_APPEND flag. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-6368)

It was discovered that GNU C Library had a stack overflow in the wordexp function when expanding paths beginning with a tilde followed by a long username. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-6791)

It was discovered that GNU C Library had a hang in the SHIFT_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-77117)

It was discovered that GNU C Library had a hang in the EUC_JISX0213 character set converter. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-80489)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.152.35-0ubuntu3.15Fixed in this release
6.8.5.018Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.142.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibc-binExternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibc-dev-binInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibc6Externally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibc6-devInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlocalesInternally-facing2.35-0ubuntu3.132.35-0ubuntu3.15Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-77117, CVE-2026-19499, CVE-2026-19542, CVE-2026-6791, CVE-2026-6368, CVE-2026-80489

References

https://ubuntu.com/security/notices/USN-8737-1

https://nvd.nist.gov/vuln/detail/CVE-2026-77117

https://nvd.nist.gov/vuln/detail/CVE-2026-19499

https://nvd.nist.gov/vuln/detail/CVE-2026-19542

https://nvd.nist.gov/vuln/detail/CVE-2026-6791

https://nvd.nist.gov/vuln/detail/CVE-2026-6368

https://nvd.nist.gov/vuln/detail/CVE-2026-80489

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
Ubuntu 22.04 LTSglibc2.35-0ubuntu3.15
resoluteglibc2.43-2ubuntu2.4