[PATCH] Add advisory text for CVE-2025-15281

[Adhemerval Zanella Netto]

On 20/01/26 11:32, Siddhesh Poyarekar wrote:
> On 2026-01-20 08:42, Carlos O'Donell wrote:
>> Explain the security issue and set context for the vulnerability to help
>> downstreams get a better understanding of the issue.
>> ---
>>   advisories/GLIBC-SA-2026-0003 | 23 +++++++++++++++++++++++
>>   1 file changed, 23 insertions(+)
>>   create mode 100644 advisories/GLIBC-SA-2026-0003
> 
> Reviewed-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
> 
>> diff --git a/advisories/GLIBC-SA-2026-0003 b/advisories/GLIBC-SA-2026-0003
>> new file mode 100644
>> index 0000000000..6f78548dfb
>> --- /dev/null
>> +++ b/advisories/GLIBC-SA-2026-0003
>> @@ -0,0 +1,23 @@
>> +wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory
>> +
>> +Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the
>> +GNU C Library version 2.0 to version 2.42 may cause the interface to
>> +return uninitialized memory in the we_wordv member, which on subsequent
>> +calls to wordfree may abort the process.
>> +
>> +The implementation of WRDE_REUSE in conjunction with WRDE_APPEND fails
>> +to clear the we_wordc member of the structure, and as such, when new
>> +words are added internally, a leading we_wordc count number of entries
>> +are skipped since they are assumed initialized.  These skipped entries
>> +are not initialized, but are the contents of a realloc-expanded array of
>> +pointers.  If the caller inspects the we_wordv array, it will
>> +dereference invalid pointers and crash. If the caller calls wordfree,
>> +the malloc implementation may detect the invalid pointers and abort the
>> +process.  Calls to wordexp using WRDE_REUSE and WRDE_APPEND have never
>> +worked correctly and thus the existence of applications that make use of
>> +this feature is unlikley.
>> +
>> +CVE-Id: CVE-2025-15281
>> +Public-Date: 2026-01-20
>> +Vulnerable-Commit: 8f2ece695d8822e9ecc63ecd157e90bf17a6fe65
> 
> I assume you (or Adhemerval) will update this later using process-advisories.sh.

I can do it.