[to-be-committed] Document CVE-2026-6238

[Florian Weimer]

* Carlos O'Donell:

> On 4/28/26 12:45 AM, Florian Weimer wrote:
>> * Siddhesh Poyarekar:
>> 
>>> Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
>>> ---
>>>   advisories/GLIBC-SA-2026-0012 | 18 ++++++++++++++++++
>>>   1 file changed, 18 insertions(+)
>>>   create mode 100644 advisories/GLIBC-SA-2026-0012
>>>
>>> diff --git a/advisories/GLIBC-SA-2026-0012 b/advisories/GLIBC-SA-2026-0012
>>> new file mode 100644
>>> index 0000000000..29498d905e
>>> --- /dev/null
>>> +++ b/advisories/GLIBC-SA-2026-0012
>>> @@ -0,0 +1,18 @@
>>> +Buffer overread in ns_printrrf with corrupted RDATA field
>>> +
>>> +The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the
>>> +GNU C Library version 2.2 and newer fail to validate the RDATA content
>>> +against the RDATA length in a DNS response when processing LOC, CERT,
>>> +TKEY or TSIG records, which may allow an attacker to craft a DNS
>>> +response, causing a target application to crash or read uninitialized
>>> +memory.
>> Note that this code was present in glibc before 2.2.
>>          case T_LOC: {
>>                  char t[255];
>>                  (void) fprintf(file, "\t%s", loc_ntoa(cp, t));
>>                  cp += dlen;
>>                  break;
>>              }
>> It's in the tree that is tagged glibc-1.90.
>
> May you please propose a different Vulnerable-Commit with updated text?
>
> We can keep updating the advisories with more accurate information as
> we receive it from reviewers.

It's not helpful because of the imperfect CVS conversion:

commit ee188d555b8c32ad9704a7440cab400af967292f
Author: Roland McGrath <roland@gnu.org>
Date:   Wed Jun 5 01:07:21 1996 +0000

Thanks,
Florian