-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 10 Oct 2026 19:56:39 +0200
Source: glibc
Binary: glibc-doc glibc-source libc-l10n locales
Architecture: all
Version: 2.41-12+deb13u5
Distribution: trixie
Urgency: medium
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description:
 glibc-doc  - GNU C Library: Documentation
 glibc-source - GNU C Library: sources
 libc-l10n  - GNU C Library: localization files
 locales    - GNU C Library: National Language (locale) data [support]
Closes: 1135230 1135231 1144252 1145880 1145891 1145987 1146721 1147395 1148168 1148727 1148728 1149647
Changes:
 glibc (2.41-12+deb13u5) trixie; urgency=medium
 .
   * debian/patches/git-updates.diff: update from upstream stable branch:
     - Cache cpuid results in ld.so for Intel CPUs.
     - Fix a buffer overread in ns_sprintrrf with corrupted RDATA field
       (CVE-2026-6238).  Closes: #1135231.
     - Fix an out-of-bounds write in ns_sprintrrf when printing TSIG records
       (CVE-2026-5435).  Closes: #1135230.
     - Fix stack overflow in wordexp tilde expansion (CVE-2026-6791).
     - Fix wordexp WRDE_APPEND to preserve state on non-NOSPACE errors
       (CVE-2026-6368).  Closes: #1144252.
     - Fix out-of-bounds stack array write in tdelete (CVE-2026-19542).
     - Fix a buffer overflow in strfmon right-justification padding
       (CVE-2026-19499).  Closes: #1145891.
     - Fix a hang when decoding SHIFT_JISX0213 to UTF-32 (CVE-2026-77117).
       Closes: #1145880.
     - Fix a hand when decoding EUC_JISX0213 to UTF-32 (CVE-2026-80489).
       Closes: #1145987.
     - Fix a heap buffer overlow in how fopen() parses the ,ccs= mode suffix
       (CVE-2026-18374).  Closes: #1146721.
     - Keep needed last transition to new type in TZif files generated by zic.
     - Fix an assertion failure in the DNS stub resolver with a long search
       domain (CVE-2026-8674).  Closes: #1148168.
     - Fix a stack overflow in nscd that can be triggered by large DNS responses
       from malicious servers (CVE-2026-89092).  Closes: #1147395.
     - Fix a TOCTOU race condition in the dynamic loader (CVE-2026-86805).
       Closes: #1148727.
     - Fix a stack overflow in the dynamic loader (CVE-2026-95818).  Closes:
       #1148728.
     - Fix one byte overread in POWER8 version of strncasecmp()
       (CVE-2026-97399).  Closes: #1149647
Checksums-Sha1:
 e0c627deaf1e1dc975d9c20dc3d51693766a0a4c 3829820 glibc-doc_2.41-12+deb13u5_all.deb
 49b3eed5205ef8f7a4a906eb96025a2bbd93fa95 20978104 glibc-source_2.41-12+deb13u5_all.deb
 f7264b02237894c42ad3691bb6a388bd320ab3ed 10980 glibc_2.41-12+deb13u5_all-buildd.buildinfo
 4756a01c43e33207c0dfda428727d015a208734d 741624 libc-l10n_2.41-12+deb13u5_all.deb
 7bdb3c6ffc0e0bd54b4f5f19ad4da8fdfc904b55 3929736 locales_2.41-12+deb13u5_all.deb
Checksums-Sha256:
 a757d670e9dc3f1d466b0d3a3f1726997bc99f16cf79549857e1364cb17b7e46 3829820 glibc-doc_2.41-12+deb13u5_all.deb
 17a09929a51434c5301870caf36776ccc132c48da31a9c7ef2ffcc39582ea49c 20978104 glibc-source_2.41-12+deb13u5_all.deb
 ae2cdc7bfe6bfbe147242849eac9e7926932c0c610c974d1ea6460429a6cd0c2 10980 glibc_2.41-12+deb13u5_all-buildd.buildinfo
 2973fcad6e05fcc7e96076ecc327fada86c3a1483087d635284cf39f0f4b754a 741624 libc-l10n_2.41-12+deb13u5_all.deb
 b80a4fa51108cf50410d28341bad4c95f43b776103a1f154317b610a4523a3c8 3929736 locales_2.41-12+deb13u5_all.deb
Files:
 0ed85940779dc62bf3f212994b7ae7a0 3829820 doc optional glibc-doc_2.41-12+deb13u5_all.deb
 a64cee7637fdeb72da10fd261428c279 20978104 devel optional glibc-source_2.41-12+deb13u5_all.deb
 d746a52532b114e07d2d99d9894a575b 10980 libs required glibc_2.41-12+deb13u5_all-buildd.buildinfo
 e8a3ee6a3a6ed2b088bf1faa83ab1490 741624 localization standard libc-l10n_2.41-12+deb13u5_all.deb
 15febb8d4a6296616a1ffb447eeca8bc 3929736 localization standard locales_2.41-12+deb13u5_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmr4UOMACgkQaBVi67oX
tfk2tw/9FETzv5a48FX0v4Hl9CYn84WGosFmTtJ6qkExBE/Cpp6MjayvqDB3eFle
4ofI5VUzLUbJ/O6ZDB8VEpKVsFmCIIlUvk94V2xp6gkqK9ZFxGzmg77FmAe7s2Ik
O1X5/MDFNcdilf3JDLfj25f43o9O8gX23vZ7j2OSQeSe2NXVxOat4lOIdFUn79mw
39gC0Zo3HPiJ2pK7gw9NeRZSCEPKL2AfrReTaz96Wk77gCJMqBL8xchg0DtZwSGk
5pCVD4a3JjMY64q39aXq7A2G6NEng/jxtulEvAWBEUELQtTtpwQ+FUsPKJO0llsn
MXoU+gloTFJmqW/422wzH86N1F/yKScw+oR0wcag3eNMlwePKtz3NEKkp2afovad
wjrlE3w2DXedJcBFBe6brtjpFuGtBsZ4k9BiPKLTrdVyIFL84TrT+MWPkIAH1Qq2
ZAqNrYlU9Yyde0ZG+MQl1qIewM37dXRu3Zj9gPMEuOFoII/teD0zLzR6EXWkgrQM
yS4Lgzl6Sq/WAhyPes8/ch3QQd6vW+1KEQYNRC3maVHuQ9Jp4pLyI+xCBWdq4WUj
Iz0+EcLg6e0B5W27/Jmi+oFEhaOBqqGEp8bulZEpu5lB0/0sN/GWlPocMFz/e6nj
fLjAw9xn0udjkVVmeThSEsH8qm1ZR7h+3rCd1LUQDrItMJtedgw=
=CSk3
-----END PGP SIGNATURE-----